Merge pull request #26 from opensourcecobol/bugfixCdCOPY

n-isaka · n-isaka · commit dae244ab56be · 2016-04-15T14:32:19.000+09:00
CBL_COPY_FILE利用時の不正なメモリ参照
diff --git a/libcob/fileio.c b/libcob/fileio.c
@@ -5131,6 +5131,7 @@ CBL_COPY_FILE (unsigned char *fname1, unsigned char *fname2)
 {
 	char	*fn1;
 	char	*fn2;
+	char	buf[COB_SMALL_BUFF];
 	int	flag = O_BINARY;
 	int	ret;
 	int	i;
@@ -5166,8 +5167,8 @@ CBL_COPY_FILE (unsigned char *fname1, unsigned char *fname2)
 	}
 	free (fn2);
 	ret = 0;
-	while ((i = read (fd1, fn1, sizeof(fn1))) > 0) {
-		if (write (fd2, fn1, (size_t)i) < 0) {
+	while ((i = read (fd1, buf, sizeof(buf))) > 0) {
+		if (write (fd2, buf, (size_t)i) < 0) {
 			ret = -1;
 			break;
 		}

Original file line number	Diff line number	Diff line change
`@@ -5131,6 +5131,7 @@ CBL_COPY_FILE (unsigned char fname1, unsigned char fname2)`
`5131`	`5131`	`{`
`5132`	`5132`	`char *fn1;`
`5133`	`5133`	`char *fn2;`
	`5134`	`+ char buf[COB_SMALL_BUFF];`
`5134`	`5135`	`int flag = O_BINARY;`
`5135`	`5136`	`int ret;`
`5136`	`5137`	`int i;`
`@@ -5166,8 +5167,8 @@ CBL_COPY_FILE (unsigned char fname1, unsigned char fname2)`
`5166`	`5167`	`}`
`5167`	`5168`	`free (fn2);`
`5168`	`5169`	`ret = 0;`
`5169`		`- while ((i = read (fd1, fn1, sizeof(fn1))) > 0) {`
`5170`		`- if (write (fd2, fn1, (size_t)i) < 0) {`
	`5170`	`+ while ((i = read (fd1, buf, sizeof(buf))) > 0) {`
	`5171`	`+ if (write (fd2, buf, (size_t)i) < 0) {`
`5171`	`5172`	`ret = -1;`
`5172`	`5173`	`break;`
`5173`	`5174`	`}`