devs/foxbox
1
0
Fork 0
forked from len0rd/rockbox
Code Pull requests Activity

Fix buffer overflow in the title padding code (FS#8163)

Browse source 
git-svn-id: svn://svn.rockbox.org/rockbox/trunk@15633 a1c6a512-1295-4272-9138-f99709370657
This commit is contained in:
Linus Nielsen Feltzing 2007-11-16 08:18:08 +00:00
parent 7197d9dde7
commit 34d08b235e
1 changed files with 8 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

14
apps/menu.c
View file

@ -24,6 +24,7 @@
#include <stdbool.h> #include <stdbool.h>
#include <stdlib.h> #include <stdlib.h>
#include "config.h" #include "config.h"
#include "system.h"
#include "lcd.h" #include "lcd.h"
#include "font.h" #include "font.h"
@ -288,8 +289,9 @@ bool do_setting_from_menu(const struct menu_item_ex *temp)
else else
title = ID2P(setting->lang_id); title = ID2P(setting->lang_id);
/* this is needed so the scroll settings title /* Pad the title string by repeating it. This is needed
can actually be used to test the setting */ so the scroll settings title can actually be used to
test the setting */
if (setting->flags&F_PADTITLE) if (setting->flags&F_PADTITLE)
{ {
int i = 0, len; int i = 0, len;
@ -298,11 +300,11 @@ bool do_setting_from_menu(const struct menu_item_ex *temp)
else else
title = P2STR((unsigned char*)title); title = P2STR((unsigned char*)title);
len = strlen(title); len = strlen(title);
while (i<MAX_PATH) while (i < MAX_PATH-1)
{ {
strncpy(&padded_title[i], title, int padlen = MIN(len, MAX_PATH-1-i);
len<MAX_PATH-1-i?len:MAX_PATH-1-i); strncpy(&padded_title[i], title, padlen);
i += len; i += padlen;
if (i<MAX_PATH-1) if (i<MAX_PATH-1)
padded_title[i++] = ' '; padded_title[i++] = ' ';
} }