Fixed potential buffer overflow in Linux CD code (thanks Ryan!)
authorSam Lantinga <slouken@libsdl.org>
Thu, 09 Aug 2001 05:34:17 +0000
changeset 139 ef23a1bf1244
parent 138 69ee0b88b615
child 140 3c35d8f160bd
Fixed potential buffer overflow in Linux CD code (thanks Ryan!)
src/cdrom/linux/SDL_syscdrom.c
--- a/src/cdrom/linux/SDL_syscdrom.c	Thu Aug 09 05:31:32 2001 +0000
+++ b/src/cdrom/linux/SDL_syscdrom.c	Thu Aug 09 05:34:17 2001 +0000
@@ -181,10 +181,21 @@
 
 	mntfp = setmntent(mtab, "r");
 	if ( mntfp != NULL ) {
-		char *tmp, mnt_type[32], mnt_dev[1024];
+		char *tmp;
+		char *mnt_type;
+		char *mnt_dev;
 
 		while ( (mntent=getmntent(mntfp)) != NULL ) {
-			/* Warning, possible buffer overflow.. */
+			mnt_type = malloc(strlen(mntent->mnt_type) + 1);
+			if (mnt_type == NULL)
+				continue;  /* maybe you'll get lucky next time. */
+
+			mnt_dev = malloc(strlen(mntent->mnt_fsname) + 1);
+			if (mnt_dev == NULL) {
+				free(mnt_type);
+				continue;
+			}
+
 			strcpy(mnt_type, mntent->mnt_type);
 			strcpy(mnt_dev, mntent->mnt_fsname);
 
@@ -216,6 +227,8 @@
 					AddDrive(mnt_dev, &stbuf);
 				}
 			}
+			free(mnt_dev);
+			free(mnt_type);
 		}
 		endmntent(mntfp);
 	}