tftp/SOURCES/tftp-hpa-0.49-fortify-strcpy-crash.patch
2022-03-01 12:21:11 +00:00

27 lines
712 B
Diff

diff -urN tftp-hpa-0.49.orig/tftp/tftp.c tftp-hpa-0.49/tftp/tftp.c
--- tftp-hpa-0.49.orig/tftp/tftp.c 2008-10-20 18:08:31.000000000 -0400
+++ tftp-hpa-0.49/tftp/tftp.c 2009-08-05 09:47:18.072585848 -0400
@@ -279,15 +279,16 @@
struct tftphdr *tp, const char *mode)
{
char *cp;
+ size_t len;
tp->th_opcode = htons((u_short) request);
cp = (char *)&(tp->th_stuff);
- strcpy(cp, name);
- cp += strlen(name);
- *cp++ = '\0';
- strcpy(cp, mode);
- cp += strlen(mode);
- *cp++ = '\0';
+ len = strlen(name) + 1;
+ memcpy(cp, name, len);
+ cp += len;
+ len = strlen(mode) + 1;
+ memcpy(cp, mode, len);
+ cp += len;
return (cp - (char *)tp);
}