Commit Graph

2 Commits

Author SHA1 Message Date
bde
0184c7ba03 Obtained from: 1.1.5
getcwd() has two off-by-one bugs in FreeBSD-2.0:

1. getcwd(buf, size) fails when the size is just large enough.
2. getcwd(buf + 1, 1) incorrectly succeeds when the current directory
   is "/".  buf[0] and buf[2] are clobbered.

(I modified Bruce's original patch to return the proper error code
[ERANGE] in the case of #2, but otherwise... -DG)

This program demonstrates the bug:

---
#include <stdlib.h>
#include <string.h>
#include <stdio.h>
#include <unistd.h>

int main(void)
{
    char buf[5];
    int errors;

    errors = 0;
    if (chdir("/tmp") != 0) {
        perror("chdir");
        abort();
    }
    if (getcwd(buf, 5) == NULL) {
        perror("oops, getcwd failed for buffer size = size required");
        ++errors;
    }
    if (chdir("/") != 0) {
        perror("chdir");
        abort();
    }
    buf[0] = 0;
    buf[2] = 1;
    if (getcwd(buf + 1, 1) != NULL) {
        fprintf(stderr,
                "oops, getcwd succeeded for buffer size = one too small\n");
        ++errors;
    }
    if (buf[0] != 0) {
        fprintf(stderr,
                "oops, getcwd scribbled on memory before start of buffer\n");
        ++errors;
    }
    if (buf[2] != 1) {
        fprintf(stderr,
                "oops, getcwd scribbled on memory after end of buffer\n");
        ++errors;
    }
    exit(errors == 0 ? 0 : 1);
}
1994-12-12 01:29:13 +00:00
rgrimes
be22b15ae2 BSD 4.4 Lite Lib Sources 1994-05-27 05:00:24 +00:00