tftp-hpa-0.49-fortify-strcpy-crash.patch 712 B

123456789101112131415161718192021222324252627
  1. diff -urN tftp-hpa-0.49.orig/tftp/tftp.c tftp-hpa-0.49/tftp/tftp.c
  2. --- tftp-hpa-0.49.orig/tftp/tftp.c 2008-10-20 18:08:31.000000000 -0400
  3. +++ tftp-hpa-0.49/tftp/tftp.c 2009-08-05 09:47:18.072585848 -0400
  4. @@ -279,15 +279,16 @@
  5. struct tftphdr *tp, const char *mode)
  6. {
  7. char *cp;
  8. + size_t len;
  9. tp->th_opcode = htons((u_short) request);
  10. cp = (char *)&(tp->th_stuff);
  11. - strcpy(cp, name);
  12. - cp += strlen(name);
  13. - *cp++ = '\0';
  14. - strcpy(cp, mode);
  15. - cp += strlen(mode);
  16. - *cp++ = '\0';
  17. + len = strlen(name) + 1;
  18. + memcpy(cp, name, len);
  19. + cp += len;
  20. + len = strlen(mode) + 1;
  21. + memcpy(cp, mode, len);
  22. + cp += len;
  23. return (cp - (char *)tp);
  24. }