diff options
| author | Marcus Meissner <marcus@jet.franken.de> | 2017-03-04 16:19:34 +0100 |
|---|---|---|
| committer | Marcus Meissner <marcus@jet.franken.de> | 2017-03-04 16:19:34 +0100 |
| commit | 9ab2ccb28b71937670dea74aa82dc5c3e6b9462c (patch) | |
| tree | 30d9cacc563e006f92ffad607b0ad6759a9d85b4 | |
| parent | be6608b2c9350d0d991e9959cb7dafc9e6f23694 (diff) | |
| download | libgphoto2-9ab2ccb28b71937670dea74aa82dc5c3e6b9462c.tar.gz | |
avoid overflows by strcpy of filename (AFL)
| -rw-r--r-- | camlibs/ptp2/library.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/camlibs/ptp2/library.c b/camlibs/ptp2/library.c index 365ad8077..95305c03f 100644 --- a/camlibs/ptp2/library.c +++ b/camlibs/ptp2/library.c @@ -4649,7 +4649,8 @@ camera_wait_for_event (Camera *camera, int timeout, newobject = entry.u.object.oid; add_object (camera, newobject, context); C_MEM (path = malloc(sizeof(CameraFilePath))); - strcpy (path->name, entry.u.object.oi.Filename); + path->name[sizeof(path->name)-1] = '\0'; + strncpy (path->name, entry.u.object.oi.Filename, sizeof (path->name)-1); free (entry.u.object.oi.Filename); sprintf (path->folder,"/"STORAGE_FOLDER_PREFIX"%08lx/",(unsigned long)entry.u.object.oi.StorageID); get_folder_from_handle (camera, entry.u.object.oi.StorageID, entry.u.object.oi.ParentObject, path->folder); |