Attachment #8826427: Abort if callback backup path is truncated for bug #1321814

View | Details | Raw Unified | Return to bug 1321814
Collapse All | Expand All

(-)a/toolkit/mozapps/update/updater/updater.cpp (-3 / +17 lines)
Line     Link Here 
 Lines 3497-3515   int NS_main(int argc, NS_tchar **argv) Link Here 
3497
          *d = *s;
3497
          *d = *s;
3498
        ++s;
3498
        ++s;
3499
        ++d;
3499
        ++d;
3500
      } while (*s);
3500
      } while (*s);
3501
      *d = NS_T('\0');
3501
      *d = NS_T('\0');
3502
      ++d;
3502
      ++d;
3503
3503
3504
      // Make a copy of the callback executable so it can be read when patching.
3504
      // Make a copy of the callback executable so it can be read when patching.
3505
      NS_tsnprintf(gCallbackBackupPath,
3505
      {
3506
                   sizeof(gCallbackBackupPath)/sizeof(gCallbackBackupPath[0]),
3506
        const size_t bufsize =
3507
                   NS_T("%s" CALLBACK_BACKUP_EXT), argv[callbackIndex]);
3507
          sizeof(gCallbackBackupPath)/sizeof(gCallbackBackupPath[0]);
3508
        const int len =
3509
          NS_tsnprintf(gCallbackBackupPath, bufsize,
3510
                       NS_T("%s" CALLBACK_BACKUP_EXT), argv[callbackIndex]);
3511
3512
        if (len >= bufsize) {
3513
          LOG(("NS_main: callback backup path truncated"));
3514
          WriteStatusFile(USAGE_ERROR);
3515
          LogFinish();
3516
3517
          EXIT_WHEN_ELEVATED(elevatedLockFilePath, updateLockFileHandle, 1);
3518
          return 1;
3519
        }
3520
      }
3521
3508
      NS_tremove(gCallbackBackupPath);
3522
      NS_tremove(gCallbackBackupPath);
3509
      if(!CopyFileW(argv[callbackIndex], gCallbackBackupPath, true)) {
3523
      if(!CopyFileW(argv[callbackIndex], gCallbackBackupPath, true)) {
3510
        DWORD copyFileError = GetLastError();
3524
        DWORD copyFileError = GetLastError();
3511
        LOG(("NS_main: failed to copy callback file " LOG_S
3525
        LOG(("NS_main: failed to copy callback file " LOG_S
3512
             " into place at " LOG_S, argv[callbackIndex], gCallbackBackupPath));
3526
             " into place at " LOG_S, argv[callbackIndex], gCallbackBackupPath));
3513
        LogFinish();
3527
        LogFinish();
3514
        if (copyFileError == ERROR_ACCESS_DENIED) {
3528
        if (copyFileError == ERROR_ACCESS_DENIED) {
3515
          WriteStatusFile(WRITE_ERROR_ACCESS_DENIED);
3529
          WriteStatusFile(WRITE_ERROR_ACCESS_DENIED);

Return to bug 1321814