[file-roller] fix extracting files with single-character names



commit 64dbaaba67bcaba5af9e570766aebfee7d24db79
Author: Ernestas Kulik <ernestas kulik gmail com>
Date:   Sun May 1 21:32:20 2016 +0300

    fix extracting files with single-character names
    
    Functions _g_path_get_relative_basename() and compute_base_path()
    incorrectly check the length of the passed path against the length of
    the base directory for equality.
    
    In the case the lengths match, path + base_dir_len will not be an
    out-of-bounds read.
    
    https://bugzilla.gnome.org/show_bug.cgi?id=761582

 src/fr-command.c |    2 +-
 src/glib-utils.c |    2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)
---
diff --git a/src/fr-command.c b/src/fr-command.c
index f4d0af6..14da9e9 100644
--- a/src/fr-command.c
+++ b/src/fr-command.c
@@ -1946,7 +1946,7 @@ compute_base_path (const char *base_dir,
                return new_path;
        }
 
-       if (path_len <= base_dir_len)
+       if (path_len < base_dir_len)
                return NULL;
 
        base_path = path + base_dir_len;
diff --git a/src/glib-utils.c b/src/glib-utils.c
index 6ccf33a..d7bd51c 100644
--- a/src/glib-utils.c
+++ b/src/glib-utils.c
@@ -1034,7 +1034,7 @@ _g_path_get_relative_basename (const char *path,
                return (path[0] == '/') ? path + 1 : path;
 
        base_dir_len = strlen (base_dir);
-       if (strlen (path) <= base_dir_len)
+       if (strlen (path) < base_dir_len)
                return NULL;
 
        base_path = path + base_dir_len;


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]