Fix default filename buffer overflow.

Note: this is not a security issue.

Noticed by: Mike Frysinger <vapier@gentoo.org>

svn path=/trunk/yasm/; revision=1884

diff --git a/frontends/yasm/yasm.c b/frontends/yasm/yasm.c
index 2aaa90e13d834ac681d22ef695ba9f2e58d6058e..775717428de21776659c7a23cee33e2c69966a4e 100644 (file)
--- a/frontends/yasm/yasm.c
+++ b/frontends/yasm/yasm.c
@@ -1135,9 +1135,17 @@ replace_extension(const char *orig, /*@null@*/ const char *ext,
                   const char *def)
 {
     char *out, *outext;
+    size_t deflen, outlen;
 
     /* allocate enough space for full existing name + extension */
-    out = yasm_xmalloc(strlen(orig)+(ext ? (strlen(ext)+2) : 1));
+    outlen = strlen(orig) + 2;
+    if (ext)
+        outlen += strlen(ext) + 1;
+    deflen = strlen(def) + 1;
+    if (outlen < deflen)
+        outlen = deflen;
+    out = yasm_xmalloc(outlen);
+
     strcpy(out, orig);
     outext = strrchr(out, '.');
     if (outext) {