GeezerVison is showing github.com — fs: fix out-of-bounds write in mkdtemp for long prefixes · nodejs/node@992af05
File tree
Expand file treeCollapse file tree
Open diff view settings
Expand file treeCollapse file tree
Open diff view settings
Collapse file
Copy file name to clipboardExpand all lines: src/node_file.cc +5-4Lines changed: 5 additions & 4 deletions | Original file line number | Diff line number | Diff line change |
|---|
@@ -3649,10 +3649,11 @@ static void Mkdtemp(const FunctionCallbackInfo<Value>& args) { |
3649 | 3649 | CHECK_GE(argc, 2); |
3650 | 3650 |
|
3651 | 3651 | BufferValue tmpl(isolate, args[0]); |
3652 | | - static constexpr const char* const suffix = "XXXXXX"; |
3653 | | - const auto length = tmpl.length(); |
3654 | | - tmpl.AllocateSufficientStorage(length + strlen(suffix)); |
3655 | | - snprintf(tmpl.out() + length, tmpl.length(), "%s", suffix); |
| 3652 | + const auto prefix_length = tmpl.length(); |
| 3653 | + static constexpr std::string_view suffix = "XXXXXX"; |
| 3654 | + tmpl.AllocateSufficientStorage(prefix_length + suffix.size() + 1); |
| 3655 | + memcpy(tmpl.out() + prefix_length, suffix.data(), suffix.size()); |
| 3656 | + tmpl.SetLengthAndZeroTerminate(prefix_length + suffix.size()); |
3656 | 3657 |
|
3657 | 3658 | CHECK_NOT_NULL(*tmpl); |
3658 | 3659 |
|
|