* grub-core/fs/iso9660.c (grub_iso9660_iterate_dir): Fix grub_strncat

	argument (access out of bounds).

diff --git a/ChangeLog b/ChangeLog
index 506036d5addfbd409bb7427b162ca5839e2c8ead..ef82df3af3107e8e4d88330b0d39d79071722a40 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+2011-11-10  Vladimir Serbinenko  <phcoder@gmail.com>
+
+       * grub-core/fs/iso9660.c (grub_iso9660_iterate_dir): Fix grub_strncat
+       argument (access out of bounds).
+
 2011-11-10  Vladimir Serbinenko  <phcoder@gmail.com>
 
        * grub-core/fs/btrfs.c (grub_btrfs_read_logical): Fix RAID10 logic for

diff --git a/grub-core/fs/iso9660.c b/grub-core/fs/iso9660.c
index d4c52bed40cc325979212710597d9f89d248f4e0..5e2f7824abc0ae4751a16c6f6f106f79e738cfab 100644 (file)
--- a/grub-core/fs/iso9660.c
+++ b/grub-core/fs/iso9660.c
@@ -559,9 +559,9 @@ grub_iso9660_iterate_dir (grub_fshelp_node_t dir,
            filename = "..";
          else if (entry->len >= 5)
            {
-             int size = 1;
+             grub_size_t size = 1, csize = 1;
              char *old;
-             size = entry->len - 5;
+             csize = size = entry->len - 5;
              old = filename;
              if (filename_alloc)
                {
@@ -580,7 +580,7 @@ grub_iso9660_iterate_dir (grub_fshelp_node_t dir,
                  return grub_errno;
                }
              filename_alloc = 1;
-             grub_strncat (filename, (char *) &entry->data[1], size);
+             grub_strncat (filename, (char *) &entry->data[1], csize);
              filename[size] = '\0';
            }
        }