Replace occurences of strcpy and strcat by strlcpy and strlcat. At both places, while improbable, it was possible to get string overflows.
CID 9043, 9044 git-svn-id: file:///srv/svn/repos/haiku/haiku/trunk@40650 a95241bf-73f2-0310-859d-f6bbb57e9c96
This commit is contained in:
@@ -2996,7 +2996,7 @@ FSCreateNewFolderIn(const node_ref *dirNode, entry_ref *newRef,
|
|||||||
status_t result = dir.InitCheck();
|
status_t result = dir.InitCheck();
|
||||||
if (result == B_OK) {
|
if (result == B_OK) {
|
||||||
char name[B_FILE_NAME_LENGTH];
|
char name[B_FILE_NAME_LENGTH];
|
||||||
strcpy(name, B_TRANSLATE("New folder"));
|
strlcpy(name, B_TRANSLATE("New folder"), sizeof(name));
|
||||||
|
|
||||||
int32 fnum = 1;
|
int32 fnum = 1;
|
||||||
while (dir.Contains(name)) {
|
while (dir.Contains(name)) {
|
||||||
|
|||||||
@@ -1319,9 +1319,9 @@ FindPanel::PushMimeType(BQuery *query) const
|
|||||||
if (strcmp(kAllMimeTypes, type)) {
|
if (strcmp(kAllMimeTypes, type)) {
|
||||||
// add an asterisk if we are searching for a supertype
|
// add an asterisk if we are searching for a supertype
|
||||||
char buffer[B_FILE_NAME_LENGTH];
|
char buffer[B_FILE_NAME_LENGTH];
|
||||||
if (strchr(type,'/') == NULL) {
|
if (strchr(type, '/') == NULL) {
|
||||||
strcpy(buffer,type);
|
strlcpy(buffer, type, sizeof(buffer));
|
||||||
strcat(buffer,"/*");
|
strlcat(buffer, "/*", sizeof(buffer));
|
||||||
type = buffer;
|
type = buffer;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|||||||
Reference in New Issue
Block a user