* cdda_read_dir() could copy too many bytes into the provided buffer (worst

case was an unterminated string, though).
* fix_dirent() did not copy the trailing null-byte.
* Not yet entirely sure why, but this caused #4214.


git-svn-id: file:///srv/svn/repos/haiku/haiku/trunk@32254 a95241bf-73f2-0310-859d-f6bbb57e9c96

src/add-ons/kernel/file_systems/cdda/kernel_interface.cpp

@@ -1865,7 +1865,8 @@ cdda_read_dir(fs_volume* _volume, fs_vnode* _node, void* _cookie,
 		}
 
 		if (user_memcpy(buffer, &entry, sizeof(struct dirent) - 1) != B_OK
-			|| user_strlcpy(buffer->d_name, name, bufferSize) < B_OK)
+			|| user_strlcpy(buffer->d_name, name,
+					bufferSize + 1 - sizeof(struct dirent)) < B_OK)
 			return B_BAD_ADDRESS;
 
 		buffer = (struct dirent*)((uint8*)buffer + entry.d_reclen);

src/system/kernel/fs/vfs.cpp

@@ -5564,7 +5564,7 @@ fix_dirent(struct vnode* parent, struct dirent* userEntry,
 		ASSERT(entry->d_reclen >= sizeof(struct dirent));
 
 		if (user_memcpy(entry->d_name, userEntry->d_name,
-				entry->d_reclen - sizeof(struct dirent)) != B_OK)
+				entry->d_reclen + 1 - sizeof(struct dirent)) != B_OK)
 			return B_BAD_ADDRESS;
 	} else
 		entry = userEntry;