Fixed buffer overflow in CD-ROM detection code.
authorRyan C. Gordon <icculus@icculus.org>
Sat, 29 Jun 2002 22:25:57 +0000
changeset 316 29a4d12d1dc6
parent 315 b209dfe09e57
child 317 3366bfb55533
Fixed buffer overflow in CD-ROM detection code.
platform/macclassic.c
platform/unix.c
--- a/platform/macclassic.c	Sat Jun 29 22:25:10 2002 +0000
+++ b/platform/macclassic.c	Sat Jun 29 22:25:57 2002 +0000
@@ -119,7 +119,7 @@
             hpbr.volumeParam.ioVolIndex = 0;
             if (PBHGetVInfoSync(&hpbr) == noErr)
             {
-                char **tmp = realloc(retval, sizeof (char *) * cd_count + 1);
+                char **tmp = realloc(retval, sizeof (char *) * (cd_count + 1));
                 if (tmp)
                 {
                     char *str = (char *) malloc(volName[0] + 1);
--- a/platform/unix.c	Sat Jun 29 22:25:10 2002 +0000
+++ b/platform/unix.c	Sat Jun 29 22:25:57 2002 +0000
@@ -91,15 +91,15 @@
 
         if (add_it)
         {
-            char **tmp = realloc(retval, sizeof (char *) * cd_count + 1);
+            char **tmp = realloc(retval, sizeof (char *) * (cd_count + 1));
             if (tmp)
             {
                 retval = tmp;
-                retval[cd_count-1] = (char *)
-                                malloc(strlen(mntbufp[ ii ].f_mntonname) + 1);
-                if (retval[cd_count-1])
+                retval[cd_count - 1] = (char *)
+                                malloc(strlen(mntbufp[ii].f_mntonname) + 1);
+                if (retval[cd_count - 1])
                 {
-                    strcpy(retval[cd_count-1], mntbufp[ ii ].f_mntonname);
+                    strcpy(retval[cd_count - 1], mntbufp[ii].f_mntonname);
                     cd_count++;
                 } /* if */
             } /* if */
@@ -137,14 +137,14 @@
 
         if (add_it)
         {
-            char **tmp = realloc(retval, sizeof (char *) * cd_count + 1);
+            char **tmp = realloc(retval, sizeof (char *) * (cd_count + 1));
             if (tmp)
             {
                 retval = tmp;
                 retval[cd_count-1] = (char *) malloc(strlen(ent->mnt_dir) + 1);
-                if (retval[cd_count-1])
+                if (retval[cd_count - 1])
                 {
-                    strcpy(retval[cd_count-1], ent->mnt_dir);
+                    strcpy(retval[cd_count - 1], ent->mnt_dir);
                     cd_count++;
                 } /* if */
             } /* if */