authorgravatar for johnnymarler@gmail.comJonathan Marler <johnnymarler@gmail.com> 2022-06-21 03:21:45-06:00
committergravatar for noreply@github.comGitHub <noreply@github.com> 2022-06-21 11:21:45+02:00
logca9862578903a93089e6aae71bb8641b580bc4f6
treed5151a8ea85fb1789d480fad1d840f8200d870f9
parent74ed7c1f0998e9dd89aa3f3480fff845afd6b422
signaturebadge-question-mark Signed by PGP key 4AEE18F83AFDEB23

std.os.execvpe: fix buffer overflow

The NameTooLong check isn't taking the sentinel 0 into account which would result in a buffer overflow on the stack.

1 files changed, 2 insertions(+), 2 deletions(-)

lib/std/os.zig+2-2
......@@ -1821,11 +1821,11 @@ pub fn execvpeZ_expandArg0(
18211821 };
18221822
18231823 while (it.next()) |search_path| {
1824 if (path_buf.len < search_path.len + file_slice.len + 1) return error.NameTooLong;
1824 const path_len = search_path.len + file_slice.len + 1;
1825 if (path_buf.len < path_len + 1) return error.NameTooLong;
18251826 mem.copy(u8, &path_buf, search_path);
18261827 path_buf[search_path.len] = '/';
18271828 mem.copy(u8, path_buf[search_path.len + 1 ..], file_slice);
1828 const path_len = search_path.len + file_slice.len + 1;
18291829 path_buf[path_len] = 0;
18301830 const full_path = path_buf[0..path_len :0].ptr;
18311831 switch (arg0_expand) {