diff options
author | Teruaki Kawashima <teru@rockbox.org> | 2010-05-21 13:30:21 +0000 |
---|---|---|
committer | Teruaki Kawashima <teru@rockbox.org> | 2010-05-21 13:30:21 +0000 |
commit | 0ac61bffa799ed4817ffd1079617ef6ac933a3f2 (patch) | |
tree | 0307bc1fee06745ec724f91f87ff6380d8289ade /firmware/drivers/lcd-bitmap-common.c | |
parent | e2d1eb6fc8c37efb049cf19a0ca38455149a67d2 (diff) | |
download | rockbox-0ac61bffa799ed4817ffd1079617ef6ac933a3f2.tar.gz rockbox-0ac61bffa799ed4817ffd1079617ef6ac933a3f2.zip |
avoid overflow in puts_scroll().
git-svn-id: svn://svn.rockbox.org/rockbox/trunk@26231 a1c6a512-1295-4272-9138-f99709370657
Diffstat (limited to 'firmware/drivers/lcd-bitmap-common.c')
-rw-r--r-- | firmware/drivers/lcd-bitmap-common.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/firmware/drivers/lcd-bitmap-common.c b/firmware/drivers/lcd-bitmap-common.c index 1b31ee8a18..fba09cf06b 100644 --- a/firmware/drivers/lcd-bitmap-common.c +++ b/firmware/drivers/lcd-bitmap-common.c | |||
@@ -321,6 +321,7 @@ void LCDFN(puts_scroll_style_offset)(int x, int y, const unsigned char *string, | |||
321 | struct scrollinfo* s; | 321 | struct scrollinfo* s; |
322 | char *end; | 322 | char *end; |
323 | int w, h; | 323 | int w, h; |
324 | int len; | ||
324 | 325 | ||
325 | if ((unsigned)y >= (unsigned)current_vp->height) | 326 | if ((unsigned)y >= (unsigned)current_vp->height) |
326 | return; | 327 | return; |
@@ -358,13 +359,14 @@ void LCDFN(puts_scroll_style_offset)(int x, int y, const unsigned char *string, | |||
358 | s->bidir = false; | 359 | s->bidir = false; |
359 | 360 | ||
360 | if (!s->bidir) { /* add spaces if scrolling in the round */ | 361 | if (!s->bidir) { /* add spaces if scrolling in the round */ |
361 | strcat(s->line, " "); | 362 | strlcat(s->line, " ", sizeof s->line); |
362 | /* get new width incl. spaces */ | 363 | /* get new width incl. spaces */ |
363 | s->width = LCDFN(getstringsize)(s->line, &w, &h); | 364 | s->width = LCDFN(getstringsize)(s->line, &w, &h); |
364 | } | 365 | } |
365 | 366 | ||
366 | end = strchr(s->line, '\0'); | 367 | end = strchr(s->line, '\0'); |
367 | strlcpy(end, string, current_vp->width/2); | 368 | len = sizeof s->line - (end - s->line); |
369 | strlcpy(end, string, MIN(current_vp->width/2, len)); | ||
368 | 370 | ||
369 | s->vp = current_vp; | 371 | s->vp = current_vp; |
370 | s->y = y; | 372 | s->y = y; |