archive/blender-archive
Archived
1
1
Fork 0
Code Pull Requests Packages Activity

Fix a buffer overflow in Blender.sys.splitext. It was checking for bounds

Browse Source 
(although it did this one char too 'friendly'), but still happily copying
the string even if it was too long.

Pythoneerz, please check if this is the correct fix :)
This commit is contained in:
Alexander Ewering
2006-05-17 10:09:20 +00:00
parent fc6597fdcf
commit 3417378a3a
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
source/blender/python/api2_2x/Sys.c
View File

@@ -300,8 +300,9 @@ static PyObject *M_sys_splitext( PyObject * self, PyObject * args )
/* loong extensions are supported -- foolish, but Python's os.path.splitext
* supports them, so ... */
if( n > FILE_MAXFILE || ( len - n ) > FILE_MAXFILE )
EXPP_ReturnPyObjError( PyExc_RuntimeError, "path too long" );
if( n >= FILE_MAXFILE || ( len - n ) >= FILE_MAXFILE )
return EXPP_ReturnPyObjError( PyExc_RuntimeError, "path too long" );
BLI_strncpy( ext, dot, n + 1 );
BLI_strncpy( path, name, dot - name + 1 );