4 files changed, 35 insertions, 6 deletions
diff --git a/cpukit/posix/src/mqueue.c b/cpukit/posix/src/mqueue.c
index 28003b8eee..1bfde0b623 100644
--- a/cpukit/posix/src/mqueue.c
+++ b/cpukit/posix/src/mqueue.c
@@ -25,6 +25,7 @@
 #include <errno.h>
 #include <fcntl.h>
 #include <mqueue.h>
+#include <limits.h>
 
 #include <rtems/system.h>
 #include <rtems/score/watchdog.h>
@@ -70,8 +71,8 @@ void _POSIX_Message_queue_Manager_initialization(
     maximum_message_queues,
     sizeof( POSIX_Message_queue_Control_fd ),
                                 /* size of this object's control block */
-    FALSE,                      /* TRUE if names for this object are strings */
-    0                           /* maximum length of each object's name */
+    TRUE,                       /* TRUE if names for this object are strings */
+    NAME_MAX                    /* maximum length of each object's name */
 #if defined(RTEMS_MULTIPROCESSING)
     ,
     FALSE,                      /* TRUE if this is a global object class */
diff --git a/cpukit/posix/src/mqueuecreatesupp.c b/cpukit/posix/src/mqueuecreatesupp.c
index 1e0aa6f57d..091da0de87 100644
--- a/cpukit/posix/src/mqueuecreatesupp.c
+++ b/cpukit/posix/src/mqueuecreatesupp.c
@@ -18,6 +18,7 @@
 #include "config.h"
 #endif
 
+#include <string.h>
 #include <stdarg.h>
 #include <stdlib.h>
 
@@ -29,10 +30,14 @@
 
 #include <rtems/system.h>
 #include <rtems/score/watchdog.h>
+#include <rtems/score/wkspace.h>
 #include <rtems/seterr.h>
 #include <rtems/posix/mqueue.h>
 #include <rtems/posix/time.h>
 
+/* pure ANSI mode does not have this prototype */
+size_t strnlen(const char *, size_t);
+
 /*PAGE
  *
  *  _POSIX_Message_queue_Create_support
@@ -42,7 +47,7 @@
  */
  
 int _POSIX_Message_queue_Create_support(
-  const char                    *_name,
+  const char                    *name_arg,
   int                            pshared,
   struct mq_attr                *attr_ptr,
   POSIX_Message_queue_Control  **message_queue
@@ -51,7 +56,12 @@ int _POSIX_Message_queue_Create_support(
   POSIX_Message_queue_Control   *the_mq;
   CORE_message_queue_Attributes *the_mq_attr;
   struct mq_attr                 attr;
-  char *name;
+  char                          *name;
+  size_t                         n;
+
+  n = strnlen( name_arg, NAME_MAX );
+  if ( n > NAME_MAX ) 
+    return ENAMETOOLONG;
 
   _Thread_Disable_dispatch();
  
@@ -100,6 +110,18 @@ int _POSIX_Message_queue_Create_support(
   the_mq->open_count = 1;
   the_mq->linked = TRUE;
 
+  /*
+   * Make a copy of the user's string for name just in case it was
+   * dynamically constructed.
+   */
+
+  name = _Workspace_Allocate(n);
+  if (!name) {
+    _POSIX_Message_queue_Free( the_mq );
+    _Thread_Enable_dispatch();
+    rtems_set_errno_and_return_minus_one( ENOMEM );
+  }
+  strcpy( name, name_arg );
  
   /* XXX
    *
@@ -123,12 +145,11 @@ int _POSIX_Message_queue_Create_support(
 #endif
  
     _POSIX_Message_queue_Free( the_mq );
+    _Workspace_Free(name);
     _Thread_Enable_dispatch();
     rtems_set_errno_and_return_minus_one( ENOSPC );
   }
 
-  name = malloc(256);
-  strcpy( name, _name );
   _Objects_Open(
     &_POSIX_Message_queue_Information,
     &the_mq->Object,
diff --git a/cpukit/posix/src/mqueuedeletesupp.c b/cpukit/posix/src/mqueuedeletesupp.c
index dfafbb578f..52421e160c 100644
--- a/cpukit/posix/src/mqueuedeletesupp.c
+++ b/cpukit/posix/src/mqueuedeletesupp.c
@@ -28,6 +28,7 @@
 
 #include <rtems/system.h>
 #include <rtems/score/watchdog.h>
+#include <rtems/score/wkspace.h>
 #include <rtems/seterr.h>
 #include <rtems/posix/mqueue.h>
 #include <rtems/posix/time.h>
@@ -42,6 +43,10 @@ void _POSIX_Message_queue_Delete(
 )
 {
   if ( !the_mq->linked && !the_mq->open_count ) {
+      /* the name memory may have been freed by unlink. */
+      if ( the_mq->Object.name )
+        _Workspace_Free( the_mq->Object.name );
+
       _Objects_Close( &_POSIX_Message_queue_Information, &the_mq->Object );
  
       _CORE_message_queue_Close(
diff --git a/cpukit/posix/src/mqueueunlink.c b/cpukit/posix/src/mqueueunlink.c
index 5d3f54db8d..0ad83ba313 100644
--- a/cpukit/posix/src/mqueueunlink.c
+++ b/cpukit/posix/src/mqueueunlink.c
@@ -28,6 +28,7 @@
 
 #include <rtems/system.h>
 #include <rtems/score/watchdog.h>
+#include <rtems/score/wkspace.h>
 #include <rtems/seterr.h>
 #include <rtems/posix/mqueue.h>
 #include <rtems/posix/time.h>
@@ -75,6 +76,7 @@ int mq_unlink(
 
  
   the_mq->linked = FALSE;
+  _Workspace_Free( the_mq->Object.name );
   _POSIX_Message_queue_Namespace_remove( the_mq );
   _POSIX_Message_queue_Delete( the_mq );