From ad9a2f44b4cbf8e22a65f9f019b7914f1a60d169 Mon Sep 17 00:00:00 2001 From: Vladimir 'phcoder' Serbinenko Date: Thu, 10 Nov 2011 08:16:27 +0100 Subject: [PATCH] * grub-core/fs/iso9660.c (grub_iso9660_iterate_dir): Fix grub_strncat argument (access out of bounds). --- ChangeLog | 5 +++++ grub-core/fs/iso9660.c | 6 +++--- 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/ChangeLog b/ChangeLog index 506036d5a..ef82df3af 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,8 @@ +2011-11-10 Vladimir Serbinenko + + * grub-core/fs/iso9660.c (grub_iso9660_iterate_dir): Fix grub_strncat + argument (access out of bounds). + 2011-11-10 Vladimir Serbinenko * grub-core/fs/btrfs.c (grub_btrfs_read_logical): Fix RAID10 logic for diff --git a/grub-core/fs/iso9660.c b/grub-core/fs/iso9660.c index d4c52bed4..5e2f7824a 100644 --- a/grub-core/fs/iso9660.c +++ b/grub-core/fs/iso9660.c @@ -559,9 +559,9 @@ grub_iso9660_iterate_dir (grub_fshelp_node_t dir, filename = ".."; else if (entry->len >= 5) { - int size = 1; + grub_size_t size = 1, csize = 1; char *old; - size = entry->len - 5; + csize = size = entry->len - 5; old = filename; if (filename_alloc) { @@ -580,7 +580,7 @@ grub_iso9660_iterate_dir (grub_fshelp_node_t dir, return grub_errno; } filename_alloc = 1; - grub_strncat (filename, (char *) &entry->data[1], size); + grub_strncat (filename, (char *) &entry->data[1], csize); filename[size] = '\0'; } }