summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorThomas Jarosch <tomj@simonv.com>2011-08-25 19:58:47 +0000
committerThomas Jarosch <tomj@simonv.com>2011-08-25 19:58:47 +0000
commite412227abbd885ae3736080b000457be69e46afc (patch)
tree0f99cffbaa66da238e9217724a2811b3bab05248
parentfaf354c4f33c49c90355bed2beafe01cf0384c1c (diff)
downloadrockbox-e412227abbd885ae3736080b000457be69e46afc.tar.gz
rockbox-e412227abbd885ae3736080b000457be69e46afc.tar.bz2
rockbox-e412227abbd885ae3736080b000457be69e46afc.zip
Fix off-by-one memory corruption in ipodpatcher.
strcpy() will terminate the string with zero, the boot sector/buffer has only space for eight characters. Credit goes to "cppcheck". git-svn-id: svn://svn.rockbox.org/rockbox/trunk@30351 a1c6a512-1295-4272-9138-f99709370657
-rw-r--r--rbutil/ipodpatcher/fat32format.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/rbutil/ipodpatcher/fat32format.c b/rbutil/ipodpatcher/fat32format.c
index 3dced355b6..9d2c538cd7 100644
--- a/rbutil/ipodpatcher/fat32format.c
+++ b/rbutil/ipodpatcher/fat32format.c
@@ -309,7 +309,7 @@ static void create_boot_sector(unsigned char* buf,
pFAT32BootSect->sJmpBoot[0]=0xEB;
pFAT32BootSect->sJmpBoot[1]=0x5A;
pFAT32BootSect->sJmpBoot[2]=0x90;
- strcpy( pFAT32BootSect->sOEMName, "MSWIN4.1" );
+ memcpy(pFAT32BootSect->sOEMName, "MSWIN4.1", 8 );
pFAT32BootSect->wBytsPerSec = rb_htole16(BytesPerSect);
pFAT32BootSect->bSecPerClus = SectorsPerCluster ;
pFAT32BootSect->wRsvdSecCnt = rb_htole16(ReservedSectCount);