diff options
| author | Thomas Jarosch <tomj@simonv.com> | 2011-08-25 19:58:47 +0000 |
|---|---|---|
| committer | Thomas Jarosch <tomj@simonv.com> | 2011-08-25 19:58:47 +0000 |
| commit | e412227abbd885ae3736080b000457be69e46afc (patch) | |
| tree | 0f99cffbaa66da238e9217724a2811b3bab05248 | |
| parent | faf354c4f33c49c90355bed2beafe01cf0384c1c (diff) | |
| download | rockbox-e412227abbd885ae3736080b000457be69e46afc.tar.gz rockbox-e412227abbd885ae3736080b000457be69e46afc.zip | |
Fix off-by-one memory corruption in ipodpatcher.
strcpy() will terminate the string with zero,
the boot sector/buffer has only space for eight characters.
Credit goes to "cppcheck".
git-svn-id: svn://svn.rockbox.org/rockbox/trunk@30351 a1c6a512-1295-4272-9138-f99709370657
| -rw-r--r-- | rbutil/ipodpatcher/fat32format.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/rbutil/ipodpatcher/fat32format.c b/rbutil/ipodpatcher/fat32format.c index 3dced355b6..9d2c538cd7 100644 --- a/rbutil/ipodpatcher/fat32format.c +++ b/rbutil/ipodpatcher/fat32format.c | |||
| @@ -309,7 +309,7 @@ static void create_boot_sector(unsigned char* buf, | |||
| 309 | pFAT32BootSect->sJmpBoot[0]=0xEB; | 309 | pFAT32BootSect->sJmpBoot[0]=0xEB; |
| 310 | pFAT32BootSect->sJmpBoot[1]=0x5A; | 310 | pFAT32BootSect->sJmpBoot[1]=0x5A; |
| 311 | pFAT32BootSect->sJmpBoot[2]=0x90; | 311 | pFAT32BootSect->sJmpBoot[2]=0x90; |
| 312 | strcpy( pFAT32BootSect->sOEMName, "MSWIN4.1" ); | 312 | memcpy(pFAT32BootSect->sOEMName, "MSWIN4.1", 8 ); |
| 313 | pFAT32BootSect->wBytsPerSec = rb_htole16(BytesPerSect); | 313 | pFAT32BootSect->wBytsPerSec = rb_htole16(BytesPerSect); |
| 314 | pFAT32BootSect->bSecPerClus = SectorsPerCluster ; | 314 | pFAT32BootSect->bSecPerClus = SectorsPerCluster ; |
| 315 | pFAT32BootSect->wRsvdSecCnt = rb_htole16(ReservedSectCount); | 315 | pFAT32BootSect->wRsvdSecCnt = rb_htole16(ReservedSectCount); |