瀏覽代碼

fix failure of tempnam to null-terminate result

tempnam uses an uninitialized buffer which is filled using memcpy and
__randname. It is therefore necessary to explicitly null-terminate it.

based on patch by Felix Janda.
Rich Felker 9 年之前
父節點
當前提交
062bb737de
共有 1 個文件被更改,包括 1 次插入0 次删除
  1. 1 0
      src/stdio/tempnam.c

+ 1 - 0
src/stdio/tempnam.c

@@ -33,6 +33,7 @@ char *tempnam(const char *dir, const char *pfx)
 	s[dl] = '/';
 	memcpy(s+dl+1, pfx, pl);
 	s[dl+1+pl] = '_';
+	s[l] = 0;
 
 	for (try=0; try<MAXTRIES; try++) {
 		__randname(s+l-6);