diff options
| author | William Wilgus <wilgus.william@gmail.com> | 2021-08-02 19:50:47 -0400 |
|---|---|---|
| committer | William Wilgus <me.theuser@yahoo.com> | 2021-08-03 00:57:35 +0000 |
| commit | 1fc4a17e1c3d774c843bdfc4f4638df2a666870e (patch) | |
| tree | a1af0b17f5a7dd56315c9a9dd447902b4ac108d3 | |
| parent | 3b6c3d769fc944a09a10f40cdfc1a29f908ab882 (diff) | |
| download | rockbox-1fc4a17e1c3d774c843bdfc4f4638df2a666870e.tar.gz rockbox-1fc4a17e1c3d774c843bdfc4f4638df2a666870e.zip | |
language.c fix possible buffer overrun
ensure zero termination regardless of data read from lang file
Change-Id: I0da0e787ffb10c9268557812b061cc3c452fbd0a
| -rw-r--r-- | apps/language.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/apps/language.c b/apps/language.c index 7fe1258dea..1ad1d5c829 100644 --- a/apps/language.c +++ b/apps/language.c | |||
| @@ -86,7 +86,7 @@ int lang_load(const char *filename, const unsigned char *builtin, | |||
| 86 | lang_init(builtin, dest, max_id); | 86 | lang_init(builtin, dest, max_id); |
| 87 | lseek(fd, foffset, SEEK_SET); | 87 | lseek(fd, foffset, SEEK_SET); |
| 88 | read(fd, buffer, lang_size); | 88 | read(fd, buffer, lang_size); |
| 89 | 89 | buffer[max_lang_size - 1] = '\0'; /* ensure buffer is null terminated */ | |
| 90 | while(lang_size>3) { | 90 | while(lang_size>3) { |
| 91 | id = ((buffer[0]<<8) | buffer[1]); /* get two-byte id */ | 91 | id = ((buffer[0]<<8) | buffer[1]); /* get two-byte id */ |
| 92 | buffer += 2; /* pass the id */ | 92 | buffer += 2; /* pass the id */ |
| @@ -100,7 +100,7 @@ int lang_load(const char *filename, const unsigned char *builtin, | |||
| 100 | while(*buffer) { /* pass the string */ | 100 | while(*buffer) { /* pass the string */ |
| 101 | lang_size--; | 101 | lang_size--; |
| 102 | buffer++; | 102 | buffer++; |
| 103 | } | 103 | } |
| 104 | lang_size-=3; /* the id and the terminating zero */ | 104 | lang_size-=3; /* the id and the terminating zero */ |
| 105 | buffer++; /* pass the terminating zero-byte */ | 105 | buffer++; /* pass the terminating zero-byte */ |
| 106 | } | 106 | } |