[Bf-blender-cvs] [2a72518] blender-v2.73-release: Fix buffer overrun calculating unique names

Campbell Barton noreply at git.blender.org
Tue Jan 6 10:44:47 CET 2015


Commit: 2a72518af753325e524a5fa5884841f4af0998cb
Author: Campbell Barton
Date:   Sun Dec 28 15:59:12 2014 +1100
Branches: blender-v2.73-release
https://developer.blender.org/rB2a72518af753325e524a5fa5884841f4af0998cb

Fix buffer overrun calculating unique names

===================================================================

M	source/blender/blenlib/intern/path_util.c

===================================================================

diff --git a/source/blender/blenlib/intern/path_util.c b/source/blender/blenlib/intern/path_util.c
index 0a30a35..8b57018 100644
--- a/source/blender/blenlib/intern/path_util.c
+++ b/source/blender/blenlib/intern/path_util.c
@@ -228,7 +228,8 @@ bool BLI_uniquename_cb(bool (*unique_check)(void *arg, const char *name),
 		int number;
 		int len = BLI_split_name_num(left, &number, name, delim);
 		do {
-			const int numlen = BLI_snprintf(numstr, sizeof(numstr), "%c%03d", delim, ++number);
+			/* add 1 to account for \0 */
+			const int numlen = BLI_snprintf(numstr, sizeof(numstr), "%c%03d", delim, ++number) + 1;
 
 			/* highly unlikely the string only has enough room for the number
 			 * but support anyway */
@@ -238,9 +239,8 @@ bool BLI_uniquename_cb(bool (*unique_check)(void *arg, const char *name),
 			}
 			else {
 				char *tempname_buf;
-				tempname[0] = '\0';
-				tempname_buf = BLI_strncat_utf8(tempname, left, name_len - numlen);
-				memcpy(tempname_buf, numstr, numlen + 1);
+				tempname_buf = tempname + BLI_strncpy_utf8_rlen(tempname, left, name_len - numlen);
+				memcpy(tempname_buf, numstr, numlen);
 			}
 		} while (unique_check(arg, tempname));




More information about the Bf-blender-cvs mailing list