From e9a6115f77e83fad6fc4a75f1bcbbe8c2c5a6c03 Mon Sep 17 00:00:00 2001 From: Sam Lantinga Date: Thu, 9 Aug 2001 05:34:17 +0000 Subject: [PATCH] Fixed potential buffer overflow in Linux CD code (thanks Ryan!) --- src/cdrom/linux/SDL_syscdrom.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/src/cdrom/linux/SDL_syscdrom.c b/src/cdrom/linux/SDL_syscdrom.c index 1766df9cf..d7806fb19 100644 --- a/src/cdrom/linux/SDL_syscdrom.c +++ b/src/cdrom/linux/SDL_syscdrom.c @@ -181,10 +181,21 @@ static void CheckMounts(const char *mtab) mntfp = setmntent(mtab, "r"); if ( mntfp != NULL ) { - char *tmp, mnt_type[32], mnt_dev[1024]; + char *tmp; + char *mnt_type; + char *mnt_dev; while ( (mntent=getmntent(mntfp)) != NULL ) { - /* Warning, possible buffer overflow.. */ + mnt_type = malloc(strlen(mntent->mnt_type) + 1); + if (mnt_type == NULL) + continue; /* maybe you'll get lucky next time. */ + + mnt_dev = malloc(strlen(mntent->mnt_fsname) + 1); + if (mnt_dev == NULL) { + free(mnt_type); + continue; + } + strcpy(mnt_type, mntent->mnt_type); strcpy(mnt_dev, mntent->mnt_fsname); @@ -216,6 +227,8 @@ static void CheckMounts(const char *mtab) AddDrive(mnt_dev, &stbuf); } } + free(mnt_dev); + free(mnt_type); } endmntent(mntfp); }