libburnia/legacy
2
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Fixed a wrong read access to memory. Reported by valgrind of lian jianfei,

Browse Source
This commit is contained in:
Thomas Schmitt 2014-07-14 18:02:14 +00:00
parent 3a3b205e34
commit a4ddd4a22e
2 changed files with 14 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
libburn/trunk/cdrskin/cdrskin_timestamp.h
View File

@ -1 +1 @@
#define Cdrskin_timestamP "2014.06.28.062807" #define Cdrskin_timestamP "2014.07.14.180122"

29
libburn/trunk/libburn/drive.c
View File

@ -1197,24 +1197,21 @@ void burn_drive_cancel(struct burn_drive *d)
} }
static void strip_spaces(char *str) static void strip_spaces(char *str, size_t len)
{ {
char *tmp; char *tmp, *tmp2;
tmp = str + strlen(str) - 1; /* Remove trailing blanks */
while (isspace(*tmp)) for (tmp = str + len - 1; tmp >= str && (isspace(*tmp) || !*tmp); tmp--)
*(tmp--) = '\0'; *tmp = 0;
/* Condense remaining blank intervals to single blanks */
tmp = str; for (tmp = str; tmp < str + len - 1 && *tmp; tmp++) {
while (*tmp) {
if (isspace(*tmp) && isspace(*(tmp + 1))) { if (isspace(*tmp) && isspace(*(tmp + 1))) {
char *tmp2; for (tmp2 = tmp + 1; tmp2 < str + len && *tmp2; tmp2++)
for (tmp2 = tmp + 1; *tmp2; ++tmp2)
*(tmp2 - 1) = *tmp2; *(tmp2 - 1) = *tmp2;
*(tmp2 - 1) = '\0'; *(tmp2 - 1) = '\0';
} else tmp--; /* try same first blank again */
++tmp; }
} }
} }
@ -1236,11 +1233,11 @@ static int drive_getcaps(struct burn_drive *d, struct burn_drive_info *out)
id = (struct burn_scsi_inquiry_data *)d->idata; id = (struct burn_scsi_inquiry_data *)d->idata;
memcpy(out->vendor, id->vendor, sizeof(id->vendor)); memcpy(out->vendor, id->vendor, sizeof(id->vendor));
strip_spaces(out->vendor); strip_spaces(out->vendor, sizeof(id->vendor));
memcpy(out->product, id->product, sizeof(id->product)); memcpy(out->product, id->product, sizeof(id->product));
strip_spaces(out->product); strip_spaces(out->product, sizeof(id->product));
memcpy(out->revision, id->revision, sizeof(id->revision)); memcpy(out->revision, id->revision, sizeof(id->revision));
strip_spaces(out->revision); strip_spaces(out->revision, sizeof(id->revision));
strncpy(out->location, d->devname, 16); strncpy(out->location, d->devname, 16);
out->location[16] = '\0'; out->location[16] = '\0';