From 1a723f0e8ec8355691842be0dd59993775ed1b99 Mon Sep 17 00:00:00 2001 From: jfreegman Date: Tue, 3 Nov 2020 13:03:47 -0500 Subject: [PATCH] Fix bad behaviour with duplicate file names If the new path is too long for the buffer we cancel the file transfer and return an error instead of truncating the file name and continuing. --- src/chat.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/src/chat.c b/src/chat.c index 49f2a07..a5d4967 100644 --- a/src/chat.c +++ b/src/chat.c @@ -638,21 +638,23 @@ static void chat_onFileRecv(ToxWindow *self, Tox *m, uint32_t friendnum, uint32_ while ((filecheck = fopen(file_path, "r"))) { fclose(filecheck); + file_path[path_len] = '\0'; - char d[9]; - sprintf(d, "(%d)", count); - ++count; + char d[5]; + snprintf(d, sizeof(d), "(%d)", count); size_t d_len = strlen(d); if (path_len + d_len >= file_path_buf_size) { - path_len = file_path_buf_size - d_len - 1; - file_path[path_len] = '\0'; + tox_file_control(m, friendnum, filenum, TOX_FILE_CONTROL_CANCEL, NULL); + line_info_add(self, NULL, NULL, NULL, SYS_MSG, 0, 0, "File transfer failed: File path too long."); + free(file_path); + return; } strcat(file_path, d); file_path[path_len + d_len] = '\0'; - if (count > 999) { + if (++count > 99) { // If there are this many duplicate file names we should probably give up tox_file_control(m, friendnum, filenum, TOX_FILE_CONTROL_CANCEL, NULL); line_info_add(self, NULL, NULL, NULL, SYS_MSG, 0, 0, "File transfer failed: invalid file path."); free(file_path);