diff --git a/include/boost/regex/v4/regex_format.hpp b/include/boost/regex/v4/regex_format.hpp index 4406839f..e05862fa 100644 --- a/include/boost/regex/v4/regex_format.hpp +++ b/include/boost/regex/v4/regex_format.hpp @@ -842,7 +842,15 @@ OutputIterator regex_format_imp(OutputIterator out, BOOST_MPL_HAS_XXX_TRAIT_DEF(const_iterator) -struct any_type { any_type(...); }; +struct any_type +{ + template + any_type(const T&); + template + any_type(const T&, const U&); + template + any_type(const T&, const U&, const V&); +}; typedef char no_type; typedef char (&unary_type)[2]; typedef char (&binary_type)[3]; diff --git a/src/cregex.cpp b/src/cregex.cpp index 5c27330c..8d69139f 100644 --- a/src/cregex.cpp +++ b/src/cregex.cpp @@ -361,11 +361,24 @@ void BuildFileList(std::list* pl, const char* files, bool recurse) while(dstart != dend) { + // Verify that sprintf will not overflow: + if(std::strlen(dstart.path()) + std::strlen(directory_iterator::separator()) + std::strlen(ptr) >= MAX_PATH) + { + // Oops overflow, skip this item: + ++dstart; + continue; + } #if BOOST_WORKAROUND(BOOST_MSVC, >= 1400) && !defined(_WIN32_WCE) && !defined(UNDER_CE) - (::sprintf_s)(buf, sizeof(buf), "%s%s%s", dstart.path(), directory_iterator::separator(), ptr); + int r = (::sprintf_s)(buf, sizeof(buf), "%s%s%s", dstart.path(), directory_iterator::separator(), ptr); #else - (std::sprintf)(buf, "%s%s%s", dstart.path(), directory_iterator::separator(), ptr); + int r = (std::sprintf)(buf, "%s%s%s", dstart.path(), directory_iterator::separator(), ptr); #endif + if(r < 0) + { + // sprintf failed, skip this item: + ++dstart; + continue; + } BuildFileList(pl, buf, recurse); ++dstart; } diff --git a/src/fileiter.cpp b/src/fileiter.cpp index ff1d1119..38c0d2c3 100644 --- a/src/fileiter.cpp +++ b/src/fileiter.cpp @@ -847,10 +847,16 @@ bool iswild(const char* mask, const char* name) unsigned _fi_attributes(const char* root, const char* name) { char buf[MAX_PATH]; + // verify that we can not overflow: + if(std::strlen(root) + std::strlen(_fi_sep) + std::strlen(name) >= MAX_PATH) + return 0; + int r; if( ( (root[0] == *_fi_sep) || (root[0] == *_fi_sep_alt) ) && (root[1] == '\0') ) - (std::sprintf)(buf, "%s%s", root, name); + r = (std::sprintf)(buf, "%s%s", root, name); else - (std::sprintf)(buf, "%s%s%s", root, _fi_sep, name); + r = (std::sprintf)(buf, "%s%s%s", root, _fi_sep, name); + if(r < 0) + return 0; // sprintf failed DIR* d = opendir(buf); if(d) { diff --git a/src/posix_api.cpp b/src/posix_api.cpp index 37ed4221..abafd8f2 100644 --- a/src/posix_api.cpp +++ b/src/posix_api.cpp @@ -167,11 +167,17 @@ BOOST_REGEX_DECL regsize_t BOOST_REGEX_CCALL regerrorA(int code, const regex_tA* { if(std::strcmp(e->re_endp, names[i]) == 0) { + // + // We're converting an integer i to a string, and since i <= REG_E_UNKNOWN + // a five character string is *always* large enough: + // #if BOOST_WORKAROUND(BOOST_MSVC, >= 1400) && !defined(_WIN32_WCE) && !defined(UNDER_CE) - (::sprintf_s)(localbuf, 5, "%d", i); + int r = (::sprintf_s)(localbuf, 5, "%d", i); #else - (std::sprintf)(localbuf, "%d", i); + int r = (std::sprintf)(localbuf, "%d", i); #endif + if(r < 0) + return 0; // sprintf failed if(std::strlen(localbuf) < buf_size) re_detail::strcpy_s(buf, buf_size, localbuf); return std::strlen(localbuf) + 1;