From 3ea4705086b9b26a4acde7e83eb05be248ade503 Mon Sep 17 00:00:00 2001 From: David Oberhollenzer Date: Sat, 25 Jan 2020 14:46:31 +0100 Subject: mtd-utils: Add checks to code that copies strings into fixed sized buffers Signed-off-by: David Oberhollenzer --- jffsX-utils/jffs2dump.c | 3 ++- ubi-utils/ubirename.c | 7 +++++++ 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/jffsX-utils/jffs2dump.c b/jffsX-utils/jffs2dump.c index ad7a9e3..d30b59f 100644 --- a/jffsX-utils/jffs2dump.c +++ b/jffsX-utils/jffs2dump.c @@ -149,7 +149,8 @@ static void process_options (int argc, char *argv[]) break; case 'e': convertendian = 1; - strcpy (cnvfile, optarg); + strncpy (cnvfile, optarg, sizeof(cnvfile) - 1); + cnvfile[sizeof(cnvfile) - 1] = '\0'; break; case 'r': recalccrc = 1; diff --git a/ubi-utils/ubirename.c b/ubi-utils/ubirename.c index f88ef82..97bf030 100644 --- a/ubi-utils/ubirename.c +++ b/ubi-utils/ubirename.c @@ -126,6 +126,13 @@ int main(int argc, char * const argv[]) rnvol.ents[count].vol_id = err; rnvol.ents[count].name_len = strlen(argv[i + 1]); + + if (rnvol.ents[count].name_len >= + sizeof(rnvol.ents[count].name)) { + errmsg("\"%s\" volume name too long", argv[i + 1]); + goto out_libubi; + } + strcpy(rnvol.ents[count++].name, argv[i + 1]); } -- cgit v1.2.3