Author: dgorbachev Date: Thu Oct 6 19:59:20 2011 New Revision: 54028
URL: http://svn.reactos.org/svn/reactos?rev=54028&view=rev Log: [HAL] Do not write past the end of buffer.
Modified: trunk/reactos/hal/halx86/legacy/bussupp.c
Modified: trunk/reactos/hal/halx86/legacy/bussupp.c URL: http://svn.reactos.org/svn/reactos/trunk/reactos/hal/halx86/legacy/bussupp.c... ============================================================================== --- trunk/reactos/hal/halx86/legacy/bussupp.c [iso-8859-1] (original) +++ trunk/reactos/hal/halx86/legacy/bussupp.c [iso-8859-1] Thu Oct 6 19:59:20 2011 @@ -736,9 +736,9 @@ VendorName += 7; p = strchr(VendorName, '\r'); Length = p - VendorName; - if (Length > sizeof(bVendorName)) Length = sizeof(bVendorName); + if (Length >= sizeof(bVendorName)) Length = sizeof(bVendorName) - 1; strncpy(bVendorName, VendorName, Length); - bVendorName[Length ] = '\0'; + bVendorName[Length] = '\0';
/* Isolate the product name */ sprintf(LookupString, "\t%04x", PciData->DeviceID); @@ -749,7 +749,7 @@ ProductName += 7; p = strchr(ProductName, '\r'); Length = p - ProductName; - if (Length > sizeof(bProductName)) Length = sizeof(bProductName); + if (Length >= sizeof(bProductName)) Length = sizeof(bProductName) - 1; strncpy(bProductName, ProductName, Length); bProductName[Length] = '\0';
@@ -765,7 +765,7 @@ SubVendorName += 13; p = strchr(SubVendorName, '\r'); Length = p - SubVendorName; - if (Length > sizeof(bSubVendorName)) Length = sizeof(bSubVendorName); + if (Length >= sizeof(bSubVendorName)) Length = sizeof(bSubVendorName) - 1; strncpy(bSubVendorName, SubVendorName, Length); bSubVendorName[Length] = '\0'; } @@ -801,7 +801,7 @@ PciData->u.type0.InterruptLine != 0 && PciData->u.type0.InterruptLine != 0xFF) DbgPrint(", IRQ %02d", PciData->u.type0.InterruptLine); DbgPrint("\n"); - + /* Scan addresses */ Size = 0; for (b = 0; b < PCI_TYPE0_ADDRESSES; b++) @@ -926,7 +926,7 @@ { /* Get the bus handler */ BusHandler = HalHandlerForBus(PCIBus, i); - + /* Loop every device */ for (j = 0; j < 32; j++) {