You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The string filenameThumb points to would be "/tmp/test-thumb.png"
The bug here is that between those 2 lines of code, /tmp/ could be changed to point to a different directory.
The solution should be to chdir() to the output file's directory, then handle the output file and thumbnail file as basenames only.
This also has the nice side effect of allowing the creation of output files with longer filenames: as the code currently stands, with a PATH_MAX of 4096 as is typical these days, if the directory portion of the filename alone is 4000 bytes, we may be unable to create a file with a basename over 95 bytes (+ 1 byte reserved for the '\0') even though X/Open guarantees NAME_MAX is at least 255.
The text was updated successfully, but these errors were encountered:
Consider the following invocation:
Scrot's execution would then be like this:
First, we'd end up on this line:
scrot/src/scrot.c
Line 158 in f1b195f
The string
filenameIM
points to would be"/tmp/test.png"
A little further down, we'd end up on this line of code:
scrot/src/scrot.c
Line 190 in f1b195f
The string
filenameThumb
points to would be"/tmp/test-thumb.png"
The bug here is that between those 2 lines of code, /tmp/ could be changed to point to a different directory.
The solution should be to
chdir()
to the output file's directory, then handle the output file and thumbnail file as basenames only.This also has the nice side effect of allowing the creation of output files with longer filenames: as the code currently stands, with a PATH_MAX of 4096 as is typical these days, if the directory portion of the filename alone is 4000 bytes, we may be unable to create a file with a basename over 95 bytes (+ 1 byte reserved for the '\0') even though X/Open guarantees NAME_MAX is at least 255.
The text was updated successfully, but these errors were encountered: