diff options
author | Tudor Florea <tudor.florea@enea.com> | 2015-10-08 22:51:41 +0200 |
---|---|---|
committer | Tudor Florea <tudor.florea@enea.com> | 2015-10-08 22:51:41 +0200 |
commit | 1219bf8a90a7bf8cd3a5363551ef635d51e8fc8e (patch) | |
tree | a21a5fc103bb3bd65ecd85ed22be5228fc54e447 /meta-networking/recipes-daemons/tftp-hpa/files/tftp-hpa-0.49-fortify-strcpy-crash.patch | |
download | meta-openembedded-1219bf8a90a7bf8cd3a5363551ef635d51e8fc8e.tar.gz |
initial commit for Enea Linux 5.0 arm
Signed-off-by: Tudor Florea <tudor.florea@enea.com>
Diffstat (limited to 'meta-networking/recipes-daemons/tftp-hpa/files/tftp-hpa-0.49-fortify-strcpy-crash.patch')
-rw-r--r-- | meta-networking/recipes-daemons/tftp-hpa/files/tftp-hpa-0.49-fortify-strcpy-crash.patch | 32 |
1 files changed, 32 insertions, 0 deletions
diff --git a/meta-networking/recipes-daemons/tftp-hpa/files/tftp-hpa-0.49-fortify-strcpy-crash.patch b/meta-networking/recipes-daemons/tftp-hpa/files/tftp-hpa-0.49-fortify-strcpy-crash.patch new file mode 100644 index 000000000..08d2b5b7d --- /dev/null +++ b/meta-networking/recipes-daemons/tftp-hpa/files/tftp-hpa-0.49-fortify-strcpy-crash.patch | |||
@@ -0,0 +1,32 @@ | |||
1 | Patch originally from Fedora | ||
2 | |||
3 | http://pkgs.fedoraproject.org/cgit/tftp.git/ | ||
4 | |||
5 | Upstream-Status: Pending | ||
6 | |||
7 | diff -urN tftp-hpa-0.49.orig/tftp/tftp.c tftp-hpa-0.49/tftp/tftp.c | ||
8 | --- tftp-hpa-0.49.orig/tftp/tftp.c 2008-10-20 18:08:31.000000000 -0400 | ||
9 | +++ tftp-hpa-0.49/tftp/tftp.c 2009-08-05 09:47:18.072585848 -0400 | ||
10 | @@ -279,15 +279,16 @@ | ||
11 | struct tftphdr *tp, const char *mode) | ||
12 | { | ||
13 | char *cp; | ||
14 | + size_t len; | ||
15 | |||
16 | tp->th_opcode = htons((u_short) request); | ||
17 | cp = (char *)&(tp->th_stuff); | ||
18 | - strcpy(cp, name); | ||
19 | - cp += strlen(name); | ||
20 | - *cp++ = '\0'; | ||
21 | - strcpy(cp, mode); | ||
22 | - cp += strlen(mode); | ||
23 | - *cp++ = '\0'; | ||
24 | + len = strlen(name) + 1; | ||
25 | + memcpy(cp, name, len); | ||
26 | + cp += len; | ||
27 | + len = strlen(mode) + 1; | ||
28 | + memcpy(cp, mode, len); | ||
29 | + cp += len; | ||
30 | return (cp - (char *)tp); | ||
31 | } | ||
32 | |||