diff options
author | Thomas Martitz <kugel@rockbox.org> | 2014-01-12 17:31:53 +0100 |
---|---|---|
committer | Thomas Martitz <kugel@rockbox.org> | 2014-01-12 17:37:16 +0100 |
commit | 193911af760d460198fc7f08bf6da824f74975b7 (patch) | |
tree | 5cdb79ab1f3093ef8967d56a2e2f3ecfb0d2ff89 /apps | |
parent | 3ae73433ab826c7a4f3c49b4d0a86fd9dc29a9cc (diff) | |
download | rockbox-193911af760d460198fc7f08bf6da824f74975b7.tar.gz rockbox-193911af760d460198fc7f08bf6da824f74975b7.zip |
put_line(): Fix buffer overflow.
At the end of the format string it wrote a last byte (or inline string) past
the end of the lcd boundaries, potentially overwriting unrelated memory. It
now makes sure it won't exceed the viewport's width.
Change-Id: Id4cfce918e8b070b7fc3c7d33f389f7a171963ff
Diffstat (limited to 'apps')
-rw-r--r-- | apps/gui/line.c | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/apps/gui/line.c b/apps/gui/line.c index fd35102ab0..5e22d6da26 100644 --- a/apps/gui/line.c +++ b/apps/gui/line.c | |||
@@ -184,6 +184,7 @@ static void print_line(struct screen *display, | |||
184 | enum themable_icons icon; | 184 | enum themable_icons icon; |
185 | char tempbuf[MAX_PATH+32]; | 185 | char tempbuf[MAX_PATH+32]; |
186 | unsigned int tempbuf_idx; | 186 | unsigned int tempbuf_idx; |
187 | int max_width = display->getwidth(); | ||
187 | 188 | ||
188 | height = line->height == -1 ? display->getcharheight() : line->height; | 189 | height = line->height == -1 ? display->getcharheight() : line->height; |
189 | icon_h = get_icon_height(display->screen_type); | 190 | icon_h = get_icon_height(display->screen_type); |
@@ -195,7 +196,7 @@ static void print_line(struct screen *display, | |||
195 | y += height/2 - display->getcharheight()/2; | 196 | y += height/2 - display->getcharheight()/2; |
196 | 197 | ||
197 | /* parse format string */ | 198 | /* parse format string */ |
198 | while (1) | 199 | while (xpos < max_width) |
199 | { | 200 | { |
200 | ch = *fmt++; | 201 | ch = *fmt++; |
201 | /* need to check for escaped '$' */ | 202 | /* need to check for escaped '$' */ |
@@ -280,8 +281,9 @@ next: | |||
280 | DEBUGF("%s ", ch ? "put_line: String truncated" : ""); | 281 | DEBUGF("%s ", ch ? "put_line: String truncated" : ""); |
281 | } | 282 | } |
282 | if (!ch) | 283 | if (!ch) |
283 | { /* end of string. put it online */ | 284 | { /* end of format string. flush pending inline string, if any */ |
284 | put_text(display, xpos, y, line, tempbuf, false, 0); | 285 | if (tempbuf[0]) |
286 | put_text(display, xpos, y, line, tempbuf, false, 0); | ||
285 | return; | 287 | return; |
286 | } | 288 | } |
287 | else if (ch == '$') | 289 | else if (ch == '$') |