hplip/fix-buffer-overflow.patch

24 lines
1.1 KiB
Diff

--- prnt/hpijs/ljcolor.cpp.orig 2007-01-25 00:42:03.000000000 +0100
+++ prnt/hpijs/ljcolor.cpp 2007-02-05 14:16:25.000000000 +0100
@@ -272,7 +272,7 @@ DRIVER_ERROR HeaderLJColor::Send ()
DRIVER_ERROR HeaderLJColor::StartSend ()
{
DRIVER_ERROR err;
- char res[64];
+ char res[67];
int iRes;
iRes = thePrintContext->EffectiveResolutionY ();
--- pcard/fat.c.orig 2006-11-14 00:58:36.000000000 +0100
+++ pcard/fat.c 2007-02-16 11:48:34.000000000 +0100
@@ -347,7 +347,8 @@ int LoadFileInCWD(int filenumber)
return FAT_FILE_DELETED;
/* Read file information from directory and convert to 8.3 format. */
- for (i=0; pde->Name[i] && (pde->Name[i] != ' ') && (i<sizeof(pde->Name)); i++) /* copy charactors up to any space */
+ /* Test for i<sizeof(pde->Name) first of all to avoid any access to pde->Name[i] when i>=sizeof(pde->Name) */
+ for (i=0; (i<sizeof(pde->Name)) && pde->Name[i] && (pde->Name[i] != ' '); i++) /* copy charactors up to any space */
fa.Name[i] = pde->Name[i];
if (pde->Ext[0] && (pde->Ext[0] != ' '))
{