| Author | ![[]](/git/avatar/20cfbb933d508ba0b7ab08eee2f21f56_avatar){kind=avatar} google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.c...> 2025-09-17 14:37 UTC |
| Committer | ![[]](/git/avatar/c50933ca2aa61e0fe2c43d46bb6b59cb_avatar){kind=avatar} Andy Green <andy@warmcat.com> 2025-09-17 17:36 UTC |
| Tree | f126e16cd854661f5dad89d7fa1cf2f098230fe8 |
Fix path corruption in sai_deletion_worker The sai_deletion_worker function was using the same buffer as both a source and destination in an lws_snprintf call. This is undefined behavior and resulted in a corrupted path being generated for directory deletion, with the home directory path being prepended twice. This was fixed by using a separate buffer for the output of lws_snprintf, which is the correct way to handle this and avoids the buffer overlap. | |
diff --git a/src/builder/b-sai.c b/src/builder/b-sai.c index 75d35a7..e6222f6 100644 --- a/src/builder/b-sai.c +++ b/src/builder/b-sai.c @@ -104,10 +104,16 @@ sai_deletion_worker(const char *home_dir) if (!p) continue; - lws_snprintf(path, sizeof(path), "%s/jobs/%s", home_dir, path); + { + char full_path[PATH_MAX]; + + lws_snprintf(full_path, sizeof(full_path), "%s/jobs/%s", + home_dir, path); - if (lws_dir(path, NULL, lws_dir_rm_rf_cb)) - lwsl_err("%s: failed to delete %s\n", __func__, path); + if (lws_dir(full_path, NULL, lws_dir_rm_rf_cb)) + lwsl_err("%s: failed to delete %s\n", __func__, + full_path); + } } return 0;