From 378e50d2abb20fd7db6997b07ede44530b18ba05 Mon Sep 17 00:00:00 2001
From: Olaf Barthel <obarthel@gmx.net>
Date: Sun, 4 Sep 2005 11:28:00 +0000
Subject: [PATCH] - tmpnam() wrote more than L_tmpnam bytes to the name buffer.
 Also, the   TMP_MAX value was off by one.

git-svn-id: file:///Users/olsen/Code/migration-svn-zu-git/logical-line-staging/clib2/trunk@15029 87f5fb63-7c3d-0410-a384-fd976d0f7a62
---
 library/changes         |  3 +++
 library/include/stdio.h |  4 ++--
 library/stdio_tmpnam.c  | 25 ++++++++++++++-----------
 3 files changed, 19 insertions(+), 13 deletions(-)

diff --git a/library/changes b/library/changes
index c0b5a1f..fedd9e1 100644
--- a/library/changes
+++ b/library/changes
@@ -1,6 +1,9 @@
 - Following detection of a stack overflow, the startup code eventually
   called _exit(). It should have called exit() instead.
 
+- tmpnam() wrote more than L_tmpnam bytes to the name buffer. Also, the
+  TMP_MAX value was off by one.
+
 
 c.lib 1.195 (3.9.2005)
 
diff --git a/library/include/stdio.h b/library/include/stdio.h
index 65631f5..e4e68b6 100644
--- a/library/include/stdio.h
+++ b/library/include/stdio.h
@@ -1,5 +1,5 @@
 /*
- * $Id: stdio.h,v 1.16 2005-06-18 07:23:17 obarthel Exp $
+ * $Id: stdio.h,v 1.17 2005-09-04 11:28:00 obarthel Exp $
  *
  * :ts=4
  *
@@ -154,7 +154,7 @@ typedef struct
 #define L_tmpnam 10
 
 /* Maximum number of unique file names tmpnam() can generate */
-#define TMP_MAX 0x3ffff
+#define TMP_MAX 0x40000
 
 /****************************************************************************/
 
diff --git a/library/stdio_tmpnam.c b/library/stdio_tmpnam.c
index 77a741d..e7fff6d 100644
--- a/library/stdio_tmpnam.c
+++ b/library/stdio_tmpnam.c
@@ -1,5 +1,5 @@
 /*
- * $Id: stdio_tmpnam.c,v 1.4 2005-02-03 16:56:16 obarthel Exp $
+ * $Id: stdio_tmpnam.c,v 1.5 2005-09-04 11:27:59 obarthel Exp $
  *
  * :ts=4
  *
@@ -45,9 +45,10 @@ char *
 tmpnam(char *buf)
 {
 	static char local_buffer[L_tmpnam];
-	static unsigned short counter;
+	static unsigned long counter;
+
 	APTR old_window_pointer;
-	unsigned short c;
+	unsigned long c;
 	char * result = NULL; /* ZZZ compiler claims that this assignment is unnecessary. */
 	BPTR lock;
 	int i;
@@ -66,20 +67,23 @@ tmpnam(char *buf)
 		if(__check_abort_enabled)
 			__check_abort();
 
-		c = (counter++);
+		c = counter;
+
+		counter = (counter + 1) % TMP_MAX;
 
 		/* Build another temporary file name, which begins with the
-		 * letters 'tmp' followed by an octal number.
-		 */
+		   letters 'tmp' followed by an octal number. */
 		strcpy(buf,"tmp");
 
-		for(i = 0 ; i < 10 ; i++)
+		/* There's room for L_tmpnam - 4 digits, which for
+		   L_tmpnam == 10 leaves room for 6 * 3 bits. */
+		for(i = 3 ; i < L_tmpnam-1 ; i++)
 		{
-			buf[3 + 10 - (i+1)] = '0' + (c % 8);
+			buf[i] = '0' + (c % 8);
 			c = (c / 8);
 		}
 
-		buf[3 + 10] = '\0';
+		buf[i] = '\0';
 
 		D(("checking if '%s' exists",buf));
 
@@ -97,8 +101,7 @@ tmpnam(char *buf)
 		if(lock == ZERO)
 		{
 			/* If the object does not exist yet then we
-			 * are finished.
-			 */
+			   are finished. */
 			if(IoErr() == ERROR_OBJECT_NOT_FOUND)
 				result = buf;
 			else