@@ -3440,16 +3440,18 @@ if (isdirectory(pathname))
34403440 while ((nextfile = readdirectory (dir )) != NULL )
34413441 {
34423442 int frc ;
3443- size_t fnlength = strlen (pathname ) + strlen (nextfile ) + 2 ;
3444- if (fnlength > FNBUFSIZ )
3443+ int prc ;
3444+ if (strlen (pathname ) + strlen (nextfile ) + 2 > sizeof (childpath ) ||
3445+ (prc = snprintf (childpath , sizeof (childpath ), "%s%c%s" , pathname ,
3446+ FILESEP , nextfile )) < 0 ||
3447+ prc >= (int )sizeof (childpath ))
34453448 {
34463449 /* LCOV_EXCL_START - this is a "never" event */
34473450 fprintf (stderr , "pcre2grep: recursive filename is too long\n" );
34483451 rc = 2 ;
34493452 break ;
34503453 /* LCOV_EXCL_STOP */
34513454 }
3452- snprintf (childpath , sizeof (childpath ), "%s%c%s" , pathname , FILESEP , nextfile );
34533455
34543456 /* If the realpath() function is available, we can try to prevent endless
34553457 recursion caused by a symlink pointing to a parent directory (GitHub
@@ -3509,15 +3511,19 @@ if (iswild(pathname))
35093511 while ((nextfile = readdirectory (dir )) != NULL )
35103512 {
35113513 int frc ;
3512- if (strlen (pathname ) + strlen (nextfile ) + 1 > sizeof (buffer ))
3514+ int prc ;
3515+ if (strlen (pathname ) + strlen (nextfile ) + 1 > sizeof (buffer ) ||
3516+ (prc = snprintf (buffer , sizeof (buffer ), "%s%s" , pathname ,
3517+ nextfile )) < 0 ||
3518+ prc >= (int )sizeof (buffer ))
35133519 {
35143520 /* LCOV_EXCL_START - this is a "never" event */
35153521 fprintf (stderr , "pcre2grep: wildcard filename is too long\n" );
35163522 rc = 2 ;
35173523 break ;
35183524 /* LCOV_EXCL_STOP */
35193525 }
3520- snprintf ( buffer , sizeof ( buffer ), "%s%s" , pathname , nextfile );
3526+
35213527 frc = grep_or_recurse (buffer , dir_recurse , FALSE);
35223528 if (frc > 1 ) rc = frc ;
35233529 else if (frc == 0 && rc == 1 ) rc = 0 ;
@@ -4064,10 +4070,10 @@ for (i = 1; i < argc; i++)
40644070 (int )strlen (arg ) : (int )(argequals - arg );
40654071
40664072 if ((ret = snprintf (buff1 , sizeof (buff1 ), "%.*s" , baselen , op -> long_name ),
4067- ret < 0 || ret > (int )sizeof (buff1 )) ||
4073+ ret < 0 || ret >= (int )sizeof (buff1 )) ||
40684074 (ret = snprintf (buff2 , sizeof (buff2 ), "%s%.*s" , buff1 ,
40694075 fulllen - baselen - 2 , opbra + 1 ),
4070- ret < 0 || ret > (int )sizeof (buff2 )))
4076+ ret < 0 || ret >= (int )sizeof (buff2 )))
40714077 {
40724078 /* LCOV_EXCL_START - this is a "never" event */
40734079 fprintf (stderr , "pcre2grep: Buffer overflow when parsing %s option\n" ,
0 commit comments