From a98440e83cb19b042958a179293bd637c400a35b Mon Sep 17 00:00:00 2001 From: "Arnold D. Robbins" Date: Fri, 17 Apr 2026 11:48:19 +0300 Subject: [PATCH] Small fix in extension/readdir.c. CVE: CVE-2026-40553 Upstream-Status: Backport [https://cgit.git.savannah.gnu.org/cgit/gawk.git/commit/?id=bfa2e4b890a44100a99d26b54af385479528b12e] (cherry picked from commit bfa2e4b890a44100a99d26b54af385479528b12e) Signed-off-by: Darsh Kelaiya --- extension/ChangeLog | 5 +++++ extension/readdir.c | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/extension/ChangeLog b/extension/ChangeLog index 6f88eb19..9fe216e6 100644 --- a/extension/ChangeLog +++ b/extension/ChangeLog @@ -1,3 +1,8 @@ +2026-04-15 Arnold D. Robbins + + * readdir.c (ftype): Use >= in check of snprintf() return + value. Thanks to Andrew Schorr . + 2026-04-15 Arnold D. Robbins * readdir.c (ftype): Use snprintf() to check for buffer diff --git a/extension/readdir.c b/extension/readdir.c index 5bbee261..3cb31834 100644 --- a/extension/readdir.c +++ b/extension/readdir.c @@ -121,7 +121,7 @@ ftype(struct dirent *entry, const char *dirname) int count; count = snprintf(fname, sizeof(fname), "%s/%s", dirname, entry->d_name); - if (count > sizeof(fname)) + if (count >= sizeof(fname)) return "u"; // buffer overflow. skip stat() call. if (stat(fname, &sbuf) == 0) { -- 2.53.0