tftp/patches/tftp-hpa-0.49-fortify-strcpy-crash.patch

   1 diff -urN tftp-hpa-0.49.orig/tftp/tftp.c tftp-hpa-0.49/tftp/tftp.c
   2 --- tftp-hpa-0.49.orig/tftp/tftp.c      2008-10-20 18:08:31.000000000 -0400
   3 +++ tftp-hpa-0.49/tftp/tftp.c   2009-08-05 09:47:18.072585848 -0400
   4 @@ -279,15 +279,16 @@
   5              struct tftphdr *tp, const char *mode)
   6  {
   7      char *cp;
   8 +    size_t len;
   9
  10      tp->th_opcode = htons((u_short) request);
  11      cp = (char *)&(tp->th_stuff);
  12 -    strcpy(cp, name);
  13 -    cp += strlen(name);
  14 -    *cp++ = '\0';
  15 -    strcpy(cp, mode);
  16 -    cp += strlen(mode);
  17 -    *cp++ = '\0';
  18 +    len = strlen(name) + 1;
  19 +    memcpy(cp, name, len);
  20 +    cp += len;
  21 +    len = strlen(mode) + 1;
  22 +    memcpy(cp, mode, len);
  23 +    cp += len;
  24      return (cp - (char *)tp);
  25  }
  26