Mirror/betaflight
1
0
Fork 0
mirror of https://github.com/betaflight/betaflight.git synced 2025-07-26 01:35:41 +03:00
Code Issues Wiki Activity

Fix buffer is accessed out of bounds

Browse source 
Fix out of bounds buffer problems caused by employing incorrect sizes
VOL_LABEL_LEN != 12 in bs->volume_label
FILE_NAME_SHRT_LEN + FILE_NAME_EXTN_LEN != 8 in entry->name
This commit is contained in:
Thomas Stibor 2020-04-04 15:08:29 +02:00
parent cb8ab75475
commit b9ccc67f1d
1 changed files with 7 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

7
src/main/msc/emfat.c
View file

@ -390,8 +390,8 @@ void read_boot_sector(const emfat_t *emfat, uint8_t *sect)
bs->volume_id[1] = 14;
bs->volume_id[2] = 13;
bs->volume_id[3] = 8;
memcpy(bs->volume_label, "NO NAME ", 12);
memcpy(bs->file_system_type, "FAT32 ", 8);
memcpy(bs->volume_label, "NO NAME ", VOL_LABEL_LEN);
memcpy(bs->file_system_type, "FAT32 ", FILE_SYS_TYPE_LENGTH);
sect[SECT - 2] = 0x55;
sect[SECT - 1] = 0xAA;
}
@ -527,8 +527,9 @@ void fill_entry(dir_entry *entry, const char *name, uint8_t attr, uint32_t clust
l2 = l2 > FILE_NAME_EXTN_LEN ? FILE_NAME_EXTN_LEN : l2;
}
memset(entry->name, ' ', FILE_NAME_SHRT_LEN + FILE_NAME_EXTN_LEN);
memset(entry->name, ' ', FILE_NAME_SHRT_LEN);
memcpy(entry->name, name, l1);
memset(entry->extn, ' ', FILE_NAME_EXTN_LEN);
memcpy(entry->extn, name + dot_pos + 1, l2);
for (i = 0; i < FILE_NAME_SHRT_LEN; i++) {