From 18c4ba9f33868761e374a725d497902863d59ea9 Mon Sep 17 00:00:00 2001 From: Victor Stinner Date: Mon, 30 Sep 2019 14:49:42 +0200 Subject: bpo-38322: Fix gotlandmark() of PC/getpathp.c (GH-16490) Write the filename into a temporary buffer instead of reusing prefix. The problem is that join() modifies prefix inplace. If prefix is not normalized, join() can make prefix shorter and so gotlandmark() does modify prefix instead of returning it unmodified. --- PC/getpathp.c | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) diff --git a/PC/getpathp.c b/PC/getpathp.c index 8bac592..04f24d9 100644 --- a/PC/getpathp.c +++ b/PC/getpathp.c @@ -315,15 +315,13 @@ canonicalize(wchar_t *buffer, const wchar_t *path) 'prefix' is null terminated in bounds. join() ensures 'landmark' can not overflow prefix if too long. */ static int -gotlandmark(wchar_t *prefix, const wchar_t *landmark) +gotlandmark(const wchar_t *prefix, const wchar_t *landmark) { - int ok; - Py_ssize_t n = wcsnlen_s(prefix, MAXPATHLEN); - - join(prefix, landmark); - ok = ismodule(prefix, FALSE); - prefix[n] = '\0'; - return ok; + wchar_t filename[MAXPATHLEN+1]; + memset(filename, 0, sizeof(filename)); + wcscpy_s(filename, Py_ARRAY_LENGTH(filename), prefix); + join(filename, landmark); + return ismodule(filename, FALSE); } -- cgit v0.12