{{ message }}
Commit 992af05
fs: fix out-of-bounds write in mkdtemp for long prefixes
Mkdtemp() allocated the template buffer as `length + strlen("XXXXXX")`,
leaving no room for the terminating NUL byte. For a single-byte prefix
long enough to force the heap allocation path (length + 6 > the
stack-buffer threshold), the terminating NUL was written one byte past
the end of the buffer -- a 1-byte heap-buffer-overflow flagged by
AddressSanitizer.
Allocate room for the terminating NUL, copy the suffix, and use
SetLengthAndZeroTerminate to set the correct length and write the
terminator, following the MaybeStackBuffer paradigm used elsewhere in
this file.
Signed-off-by: frandle331-yh <s1240100@gmail.com>
PR-URL: #64770
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>1 parent 109566a commit 992af05
1 file changed
Lines changed: 5 additions & 4 deletions
0 commit comments