Use the specified buffer length, not the maximum buffer length in

unixFullPathname() and related functions. (CVS 4595)

FossilOrigin-Name: f015a38771d98996366d66787b9b066f9ef5e248

1 files changed, 8 insertions, 6 deletions

diff --git a/src/os_unix.c b/src/os_unix.c
index cd6a074a8..29a1933b3 100644
--- a/src/os_unix.c
+++ b/src/os_unix.c
@@ -2512,10 +2512,12 @@ static int unixGetTempname(sqlite3_vfs *pVfs, int nBuf, char *zBuf){
     zDir = azDirs[i];
     break;
   }
+  if( strlen(zDir) - sizeof(SQLITE_TEMP_FILE_PREFIX) - 17 <=0 ){
+    return SQLITE_ERROR;
+  }
   do{
     assert( pVfs->mxPathname==MAX_PATHNAME );
-    assert( nBuf>=MAX_PATHNAME );
-    sqlite3_snprintf(MAX_PATHNAME-17, zBuf, "%s/"SQLITE_TEMP_FILE_PREFIX, zDir);
+    sqlite3_snprintf(nBuf-17, zBuf, "%s/"SQLITE_TEMP_FILE_PREFIX, zDir);
     j = strlen(zBuf);
     sqlite3Randomness(15, &zBuf[j]);
     for(i=0; i<15; i++, j++){
@@ -2551,16 +2553,16 @@ static int unixFullPathname(
   SimulateIOError( return SQLITE_ERROR );
 
   assert( pVfs->mxPathname==MAX_PATHNAME );
-  zOut[MAX_PATHNAME-1] = '\0';
+  zOut[nOut-1] = '\0';
   if( zPath[0]=='/' ){
-    sqlite3_snprintf(MAX_PATHNAME, zOut, "%s", zPath);
+    sqlite3_snprintf(nOut, zOut, "%s", zPath);
   }else{
     int nCwd;
-    if( getcwd(zOut, MAX_PATHNAME-1)==0 ){
+    if( getcwd(zOut, nOut-1)==0 ){
       return SQLITE_CANTOPEN;
     }
     nCwd = strlen(zOut);
-    sqlite3_snprintf(MAX_PATHNAME-nCwd, &zOut[nCwd], "/%s", zPath);
+    sqlite3_snprintf(nOut-nCwd, &zOut[nCwd], "/%s", zPath);
   }
   return SQLITE_OK;