diff options
| author | cevans@chromium.org <cevans@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2009-07-23 17:30:10 +0000 |
|---|---|---|
| committer | cevans@chromium.org <cevans@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2009-07-23 17:30:10 +0000 |
| commit | fefa8b29191ffd7730f7d3428697408bf979e6ee (patch) | |
| tree | 942cd7f524c24b8726649a86cc86665bad187568 /chrome/common/zip.cc | |
| parent | 1151e5465bf90cbabc565cd53958f18f85b7440a (diff) | |
| download | chromium_src-fefa8b29191ffd7730f7d3428697408bf979e6ee.zip chromium_src-fefa8b29191ffd7730f7d3428697408bf979e6ee.tar.gz chromium_src-fefa8b29191ffd7730f7d3428697408bf979e6ee.tar.bz2 | |
(Identical to 159254 which I had in a messed up client)
Fix an off-by-one in the zip filename reading code. It's pretty harmless, and
caused by a fairly lousy minizip API. It could lead to an out-of-bounds read
due to lack of null termination.
No way to reliably test.
BUG=NONE
TEST=NONE
Review URL: http://codereview.chromium.org/155984
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@21397 0039d316-1c4b-4281-b951-d872f2087c98
Diffstat (limited to 'chrome/common/zip.cc')
| -rw-r--r-- | chrome/common/zip.cc | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/chrome/common/zip.cc b/chrome/common/zip.cc index 9ac6da3..6909cc6 100644 --- a/chrome/common/zip.cc +++ b/chrome/common/zip.cc @@ -23,7 +23,7 @@ static bool ExtractCurrentFile(unzFile zip_file, char filename_inzip[kZipMaxPath] = {0}; unz_file_info file_info; int err = unzGetCurrentFileInfo(zip_file, &file_info, filename_inzip, - sizeof(filename_inzip), NULL, 0, NULL, 0); + sizeof(filename_inzip) - 1, NULL, 0, NULL, 0); if (err != UNZ_OK) return false; if (filename_inzip[0] == '\0') |