Check that snprintf() does not truncate the destination pathname when

linking into a directory.

1 files changed, 6 insertions, 1 deletions

diff --git a/bin/ln/ln.c b/bin/ln/ln.c
index ccae31d..0b0b46b 100644
--- a/bin/ln/ln.c
+++ b/bin/ln/ln.c
@@ -189,7 +189,12 @@ linkit(const char *target, const char *source, int isdir)
 			p = target;
 		else
 			++p;
-		(void)snprintf(path, sizeof(path), "%s/%s", source, p);
+		if (snprintf(path, sizeof(path), "%s/%s", source, p) >=
+		    sizeof(path)) {
+			errno = ENAMETOOLONG;
+			warn("%s", target);
+			return (1);
+		}
 		source = path;
 	}