-
Notifications
You must be signed in to change notification settings - Fork 56
Description
Consider the following invocation:
scrot --thumb 10 /tmp/test.pngScrot's execution would then be like this:
First, we'd end up on this line:
Line 158 in f1b195f
| imlib_save_image_with_error_return(filenameIM, &imErr); |
The string
filenameIM points to would be "/tmp/test.png"
A little further down, we'd end up on this line of code:
Line 190 in f1b195f
| imlib_save_image_with_error_return(filenameThumb, &imErr); |
The string
filenameThumb points to would be "/tmp/test-thumb.png"
The bug here is that between those 2 lines of code, /tmp/ could be changed to point to a different directory.
The solution should be to chdir() to the output file's directory, then handle the output file and thumbnail file as basenames only.
This also has the nice side effect of allowing the creation of output files with longer filenames: as the code currently stands, with a PATH_MAX of 4096 as is typical these days, if the directory portion of the filename alone is 4000 bytes, we may be unable to create a file with a basename over 95 bytes (+ 1 byte reserved for the '\0') even though X/Open guarantees NAME_MAX is at least 255.