# HG changeset patch
# User stuefe
# Date 1473759511 -7200
#      Tue Sep 13 11:38:31 2016 +0200
# Node ID 0e9fb85c392f4957dd590f5f0209439bf60cf107
# Parent  d6a338c11d88db324694fb52f9ff4735b486830b
8165936: Potential Heap buffer overflow when seaching timezone info files
Summary: readdir_r called with too small buffer
Reviewed-by: clanger, rriggs, okutsu, naoto

diff --git a/src/java.base/unix/native/libjava/TimeZone_md.c b/src/java.base/unix/native/libjava/TimeZone_md.c
--- a/src/java.base/unix/native/libjava/TimeZone_md.c
+++ b/src/java.base/unix/native/libjava/TimeZone_md.c
@@ -128,13 +128,26 @@
     char *dbuf = NULL;
     char *tz = NULL;
     int res;
+    long name_max = 0;
 
     dirp = opendir(dir);
     if (dirp == NULL) {
         return NULL;
     }
 
-    entry = (struct dirent64 *) malloc((size_t) pathconf(dir, _PC_NAME_MAX));
+    name_max = pathconf(dir, _PC_NAME_MAX);
+    // If pathconf did not work, fall back to NAME_MAX.
+    if (name_max < 0) {
+        name_max = NAME_MAX;
+    }
+    // Some older System V systems have a very small NAME_MAX size of 14; as
+    // there is no way to tell readdir_r the output buffer size, lets enforce
+    // a mimimum buffer size.
+    if (name_max < 1024) {
+        name_max = 1024;
+    }
+
+    entry = (struct dirent64 *)malloc(offsetof(struct dirent64, d_name) + name_max + 1);
     if (entry == NULL) {
         (void) closedir(dirp);
         return NULL;