1.0.13.51: Fixups in mkstemp wrapper used in RUN-PROGRAM.

* Preclude a buffer overflow (though one that cannot occur at present,
  given the single caller of this routine).  Contributed by Alex
  Plotnick.

diff --git a/src/runtime/wrap.c b/src/runtime/wrap.c
index 8e17e37..2bda7f9 100644 (file)
--- a/src/runtime/wrap.c
+++ b/src/runtime/wrap.c
@@ -305,10 +305,11 @@ int sb_mkstemp (char *template, mode_t mode) {
        template on every loop, but only the last several characters.
        But I didn't feel like testing the boundary cases in Windows's
        _mktemp. */
-    strcpy((char*)&buf, template);
-    if (MKTEMP((char*)&buf)) {
-      if ((fd=open((char*)&buf, O_CREAT|O_EXCL|O_RDWR, mode))!=-1) {
-        strcpy(template, (char*)&buf);
+    strncpy(buf, template, PATHNAME_BUFFER_SIZE);
+    buf[PATHNAME_BUFFER_SIZE-1]=0; /* force NULL-termination */
+    if (MKTEMP(buf)) {
+      if ((fd=open(buf, O_CREAT|O_EXCL|O_RDWR, mode))!=-1) {
+        strcpy(template, buf);
         return (fd);
       } else
         if (errno != EEXIST)

diff --git a/version.lisp-expr b/version.lisp-expr
index 6c05f6a..5e31ada 100644 (file)
--- a/version.lisp-expr
+++ b/version.lisp-expr
@@ -17,4 +17,4 @@
 ;;; checkins which aren't released. (And occasionally for internal
 ;;; versions, especially for internal versions off the main CVS
 ;;; branch, it gets hairier, e.g. "0.pre7.14.flaky4.13".)
-"1.0.13.50"
+"1.0.13.51"