summaryrefslogtreecommitdiffstats
path: root/meta-networking/recipes-daemons/tftp-hpa/files/tftp-hpa-0.49-fortify-strcpy-crash.patch
diff options
context:
space:
mode:
authorTudor Florea <tudor.florea@enea.com>2015-10-08 22:51:41 +0200
committerTudor Florea <tudor.florea@enea.com>2015-10-08 22:51:41 +0200
commit1219bf8a90a7bf8cd3a5363551ef635d51e8fc8e (patch)
treea21a5fc103bb3bd65ecd85ed22be5228fc54e447 /meta-networking/recipes-daemons/tftp-hpa/files/tftp-hpa-0.49-fortify-strcpy-crash.patch
downloadmeta-openembedded-1219bf8a90a7bf8cd3a5363551ef635d51e8fc8e.tar.gz
initial commit for Enea Linux 5.0 arm
Signed-off-by: Tudor Florea <tudor.florea@enea.com>
Diffstat (limited to 'meta-networking/recipes-daemons/tftp-hpa/files/tftp-hpa-0.49-fortify-strcpy-crash.patch')
-rw-r--r--meta-networking/recipes-daemons/tftp-hpa/files/tftp-hpa-0.49-fortify-strcpy-crash.patch32
1 files changed, 32 insertions, 0 deletions
diff --git a/meta-networking/recipes-daemons/tftp-hpa/files/tftp-hpa-0.49-fortify-strcpy-crash.patch b/meta-networking/recipes-daemons/tftp-hpa/files/tftp-hpa-0.49-fortify-strcpy-crash.patch
new file mode 100644
index 000000000..08d2b5b7d
--- /dev/null
+++ b/meta-networking/recipes-daemons/tftp-hpa/files/tftp-hpa-0.49-fortify-strcpy-crash.patch
@@ -0,0 +1,32 @@
1Patch originally from Fedora
2
3http://pkgs.fedoraproject.org/cgit/tftp.git/
4
5Upstream-Status: Pending
6
7diff -urN tftp-hpa-0.49.orig/tftp/tftp.c tftp-hpa-0.49/tftp/tftp.c
8--- tftp-hpa-0.49.orig/tftp/tftp.c 2008-10-20 18:08:31.000000000 -0400
9+++ tftp-hpa-0.49/tftp/tftp.c 2009-08-05 09:47:18.072585848 -0400
10@@ -279,15 +279,16 @@
11 struct tftphdr *tp, const char *mode)
12 {
13 char *cp;
14+ size_t len;
15
16 tp->th_opcode = htons((u_short) request);
17 cp = (char *)&(tp->th_stuff);
18- strcpy(cp, name);
19- cp += strlen(name);
20- *cp++ = '\0';
21- strcpy(cp, mode);
22- cp += strlen(mode);
23- *cp++ = '\0';
24+ len = strlen(name) + 1;
25+ memcpy(cp, name, len);
26+ cp += len;
27+ len = strlen(mode) + 1;
28+ memcpy(cp, mode, len);
29+ cp += len;
30 return (cp - (char *)tp);
31 }
32