dosfstools/dosfstools-filename-buffer-overflow.patch

17 lines
661 B
Diff

Index: dosfstools-3.0.10/src/check.c
===================================================================
--- dosfstools-3.0.10.orig/src/check.c
+++ dosfstools-3.0.10/src/check.c
@@ -174,7 +174,10 @@ loff_t alloc_rootdir_entry(DOS_FS *fs, D
offset = fs->root_start+next_free*sizeof(DIR_ENT);
memset(de,0,sizeof(DIR_ENT));
while (1) {
- sprintf(de->name,pattern,curr_num);
+ char expanded[12];
+ sprintf(expanded, pattern, curr_num);
+ memcpy(de->name, expanded, 8);
+ memcpy(de->ext, expanded+8, 3);
for (scan = 0; scan < fs->root_entries; scan++)
if (scan != next_free &&
!strncmp(root[scan].name,de->name,MSDOS_NAME))