From ff55e7516ae9877a3865383690053dd11d24afdd Mon Sep 17 00:00:00 2001 From: Evgeniy Gorbanyov Date: Fri, 25 Sep 2026 18:23:47 +0600 Subject: [PATCH] reject overlong directory prefixes in get_tmpname() strlcpy() was given the source length as its destination size, so a path longer than MAXPATHLEN overflowed the temporary-name buffer. Signed-off-by: Evgeniy Gorbanyov --- rsync.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/rsync.c b/rsync.c index d2ec217..e97975a 100644 --- a/rsync.c +++ b/rsync.c @@ -271,6 +271,11 @@ static int get_tmpname(char *fnametmp, const char *tempdir, const char *fname) ++f; if (!tempdir) { length = f - fname; + if (length >= MAXPATHLEN) { + csync_debug(1, "temporary filename too long: %s\n", fname); + fnametmp[0] = '\0'; + return 0; + } /* copy up to and including the slash */ strlcpy(fnametmp, fname, length + 1); }