Cwd.xs: off-by-one buffer overflow in realpath()

Message-ID: <20031103151143.GB430@geeknest.com>

p4raw-id: //depot/perl@21646

diff --git a/ext/Cwd/Cwd.xs b/ext/Cwd/Cwd.xs
index 3f7b93b..4600fef 100644 (file)
--- a/ext/Cwd/Cwd.xs
+++ b/ext/Cwd/Cwd.xs
@@ -166,7 +166,7 @@ loop:
                rootd = 0;
 
        if (*wbuf) {
-               if (strlen(resolved) + strlen(wbuf) + rootd + 1 > MAXPATHLEN) {
+               if (strlen(resolved) + strlen(wbuf) + (1 - rootd) + 1 > MAXPATHLEN) {
                        errno = ENAMETOOLONG;
                        goto err1;
                }