diff options
| author | mm <mm@FreeBSD.org> | 2011-08-23 19:49:06 +0000 |
|---|---|---|
| committer | mm <mm@FreeBSD.org> | 2011-08-23 19:49:06 +0000 |
| commit | 5ebe68dec2210c993b36a23d03da8d01570502ff (patch) | |
| tree | a94d825ffcedd9787e7610ff2b0d1bebd5dc28b9 | |
| parent | 9b0113067aa5fde33d06b44ae02ad0d66b77d8a7 (diff) | |
| download | FreeBSD-src-5ebe68dec2210c993b36a23d03da8d01570502ff.zip FreeBSD-src-5ebe68dec2210c993b36a23d03da8d01570502ff.tar.gz | |
Fix buffer overflow and possible ISO image corruption in wrong
handling of "." character case in makefs ISO level 1 and 2 filename
conversion.
Filed as NetBSD PR #45285
http://gnats.netbsd.org/cgi-bin/query-pr-single.pl?number=45285
Reviewed by: Christos Zoulas <christos@netbsd.org>
Approved by: re (kib)
MFC after: 3 days
| -rw-r--r-- | usr.sbin/makefs/cd9660.c | 10 |
1 files changed, 3 insertions, 7 deletions
diff --git a/usr.sbin/makefs/cd9660.c b/usr.sbin/makefs/cd9660.c index 44af984..b9e800d 100644 --- a/usr.sbin/makefs/cd9660.c +++ b/usr.sbin/makefs/cd9660.c @@ -1627,7 +1627,7 @@ cd9660_level1_convert_filename(const char *oldname, char *newname, int is_file) int extlen = 0; int found_ext = 0; - while (*oldname != '\0') { + while (*oldname != '\0' && extlen < 3) { /* Handle period first, as it is special */ if (*oldname == '.') { if (found_ext) { @@ -1644,10 +1644,8 @@ cd9660_level1_convert_filename(const char *oldname, char *newname, int is_file) *oldname == ',' && strlen(oldname) == 4) break; /* Enforce 12.3 / 8 */ - if (((namelen == 8) && !found_ext) || - (found_ext && extlen == 3)) { + if (namelen == 8 && !found_ext) break; - } if (islower((unsigned char)*oldname)) *newname++ = toupper((unsigned char)*oldname); @@ -1690,7 +1688,7 @@ cd9660_level2_convert_filename(const char *oldname, char *newname, int is_file) int extlen = 0; int found_ext = 0; - while (*oldname != '\0') { + while (*oldname != '\0' && namelen + extlen < 30) { /* Handle period first, as it is special */ if (*oldname == '.') { if (found_ext) { @@ -1710,8 +1708,6 @@ cd9660_level2_convert_filename(const char *oldname, char *newname, int is_file) if (diskStructure.archimedes_enabled && *oldname == ',' && strlen(oldname) == 4) break; - if ((namelen + extlen) == 30) - break; if (islower((unsigned char)*oldname)) *newname++ = toupper((unsigned char)*oldname); |
