summaryrefslogtreecommitdiff
path: root/backend/as6e.c
diff options
context:
space:
mode:
authorJörg Frings-Fürst <debian@jff-webhosting.net>2019-07-31 16:59:49 +0200
committerJörg Frings-Fürst <debian@jff-webhosting.net>2019-07-31 16:59:49 +0200
commit1687222e1b9e74c89cafbb5910e72d8ec7bfd40f (patch)
treed78102ce30207c63e7608eeba743efd680c888dc /backend/as6e.c
parent58912f68c2489bcee787599837447e0d64dfd61a (diff)
New upstream version 1.0.28upstream/1.0.28
Diffstat (limited to 'backend/as6e.c')
-rw-r--r--backend/as6e.c30
1 files changed, 19 insertions, 11 deletions
diff --git a/backend/as6e.c b/backend/as6e.c
index 76241fb..37a6d3b 100644
--- a/backend/as6e.c
+++ b/backend/as6e.c
@@ -799,7 +799,7 @@ check_for_driver (const char *devname)
char *path;
char fullname[NAMESIZE];
char dir[NAMESIZE];
- int count = 0, offset = 0;
+ int count = 0, offset = 0, valid;
path = getenv ("PATH");
if (!path)
@@ -808,21 +808,29 @@ check_for_driver (const char *devname)
{
memset (fullname, '\0', sizeof (fullname));
memset (dir, '\0', sizeof (dir));
+ valid = 1;
while ((path[count] != ':') && (path[count] != '\0'))
{
- dir[count - offset] = path[count];
+ /* prevent writing data, which are out of bounds */
+ if ((unsigned int)(count - offset) < sizeof (dir))
+ dir[count - offset] = path[count];
+ else
+ valid = 0;
count++;
}
- /* use sizeof(fullname)-1 to make sure there is at least one padded null byte */
- strncpy (fullname, dir, sizeof(fullname)-1);
- /* take into account that fullname already contains non-null bytes */
- strncat (fullname, "/", sizeof(fullname)-strlen(fullname)-1);
- strncat (fullname, devname, sizeof(fullname)-strlen(fullname)-1);
- if (!stat (fullname, &statbuf))
+ if (valid == 1)
{
- modes = statbuf.st_mode;
- if (S_ISREG (modes))
- return (1); /* found as6edriver */
+ /* use sizeof(fullname)-1 to make sure there is at least one padded null byte */
+ strncpy (fullname, dir, sizeof(fullname)-1);
+ /* take into account that fullname already contains non-null bytes */
+ strncat (fullname, "/", sizeof(fullname)-strlen(fullname)-1);
+ strncat (fullname, devname, sizeof(fullname)-strlen(fullname)-1);
+ if (!stat (fullname, &statbuf))
+ {
+ modes = statbuf.st_mode;
+ if (S_ISREG (modes))
+ return (1); /* found as6edriver */
+ }
}
if (path[count] == '\0')
return (0); /* end of path --no driver found */