From: Jan Dubois <jand@activestate.com>
Date: Tue, 13 Apr 2004 19:49:32 +0000 (-0700)
Subject: re: [PATCH] for bug 28525: Buffer overflow issue in the Win32 distribution of 5.8.3
X-Git-Url: http://git.shadowcat.co.uk/gitweb/gitweb.cgi?a=commitdiff_plain;h=1928965c335b0bc2a3df245c2070b6e4b7bfad99;p=p5sagit%2Fp5-mst-13.2.git

re: [PATCH] for bug 28525: Buffer overflow issue in the Win32 distribution of 5.8.3
Message-ID: <vm7p70h7au8unrnq4jp85oich7n71ar5ab@4ax.com

p4raw-id: //depot/perl@22691
---

diff --git a/win32/win32.c b/win32/win32.c
index b36a7b7..e18dec7 100644
--- a/win32/win32.c
+++ b/win32/win32.c
@@ -3736,7 +3736,10 @@ qualified_path(const char *cmd)
 
     /* look in PATH */
     pathstr = PerlEnv_getenv("PATH");
-    New(0, fullcmd, MAX_PATH+1, char);
+
+    /* worst case: PATH is a single directory; we need additional space
+     * to append "/", ".exe" and trailing "\0" */
+    New(0, fullcmd, (pathstr ? strlen(pathstr) : 0) + cmdlen + 6, char);
     curfullcmd = fullcmd;
 
     while (1) {
@@ -3777,17 +3780,13 @@ qualified_path(const char *cmd)
 	    if (*pathstr == '"') {	/* foo;"baz;etc";bar */
 		pathstr++;		/* skip initial '"' */
 		while (*pathstr && *pathstr != '"') {
-		    if ((STRLEN)(curfullcmd-fullcmd) < MAX_PATH-cmdlen-5)
-			*curfullcmd++ = *pathstr;
-		    pathstr++;
+                    *curfullcmd++ = *pathstr++;
 		}
 		if (*pathstr)
 		    pathstr++;		/* skip trailing '"' */
 	    }
 	    else {
-		if ((STRLEN)(curfullcmd-fullcmd) < MAX_PATH-cmdlen-5)
-		    *curfullcmd++ = *pathstr;
-		pathstr++;
+                *curfullcmd++ = *pathstr++;
 	    }
 	}
 	if (*pathstr)