From 14ebc5b618ec6d4668e120acc7a75ae8efd677e7 Mon Sep 17 00:00:00 2001 From: Wayne Davison Date: Thu, 16 Dec 2010 22:15:04 -0800 Subject: [PATCH] Fix crash when --backup-dir is excessively long. --- options.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/options.c b/options.c index 2529fe26..dc135923 100644 --- a/options.c +++ b/options.c @@ -2044,17 +2044,18 @@ int parse_arguments(int *argc_p, const char ***argv_p) return 0; } if (backup_dir) { + size_t len; while (*backup_dir == '.' && backup_dir[1] == '/') backup_dir += 2; if (*backup_dir == '.' && backup_dir[1] == '\0') backup_dir++; - backup_dir_len = strlcpy(backup_dir_buf, backup_dir, sizeof backup_dir_buf); - backup_dir_remainder = sizeof backup_dir_buf - backup_dir_len; - if (backup_dir_remainder < 128) { + len = strlcpy(backup_dir_buf, backup_dir, sizeof backup_dir_buf); + if (len > sizeof backup_dir_buf - 128) { snprintf(err_buf, sizeof err_buf, "the --backup-dir path is WAY too long.\n"); return 0; } + backup_dir_len = (int)len; if (!backup_dir_len) { backup_dir_len = -1; backup_dir = NULL; @@ -2062,6 +2063,7 @@ int parse_arguments(int *argc_p, const char ***argv_p) backup_dir_buf[backup_dir_len++] = '/'; backup_dir_buf[backup_dir_len] = '\0'; } + backup_dir_remainder = sizeof backup_dir_buf - backup_dir_len; } if (backup_dir) { /* No need for a suffix or a protect rule. */ -- 2.34.1