Skip to content

Commit

Permalink
fix buffer overflow in exec
Browse files Browse the repository at this point in the history
  • Loading branch information
iley committed Jul 2, 2011
1 parent f3a3eb9 commit 8f1194b
Show file tree
Hide file tree
Showing 3 changed files with 33 additions and 1 deletion.
6 changes: 5 additions & 1 deletion exec.inc
Expand Up @@ -9,6 +9,7 @@
;PSP is a Program Segment Prefix
PSP_ERR_MODE equ 002h ;4 is sizeof.term_instr
PSP_CMD_LINE equ 080h
PSP_CMD_LINE_LEN equ 020h
PSP_CODE_START equ 100h

term_instr:
Expand All @@ -32,9 +33,12 @@ exec:
;allocate segment for the program
call malloc

push cx
;copy command line into PSP
mov di, PSP_CMD_LINE
call strcpy
mov cx, PSP_CMD_LINE_LEN
call strncpy
pop cx

mov word[es:PSP_ERR_MODE], DEF_ERR_MODE
Expand Down
1 change: 1 addition & 0 deletions stdlib/string.inc
Expand Up @@ -8,6 +8,7 @@

include 'memset.inc'
include 'string\strcpy.inc'
include 'string\strncpy.inc'
include 'string\strcmp.inc'
include 'string\strlen.inc'
include 'string\strtok.inc'
Expand Down
27 changes: 27 additions & 0 deletions stdlib/string/strncpy.inc
@@ -0,0 +1,27 @@
; VictoriaOS: strcpy function
; Copyright Ilya Strukov, 2008

; This program is free software; you can redistribute it and/or modify
; it under the terms of the GNU General Public License as published by
; the Free Software Foundation; either version 2 of the License, or
; (at your option) any later version.

;================================================
; #proc string copy
; #input: ds:si - source, es:di - destination, cx - dest. buffer size
strncpy:
push ax cx si di
dec cx
cld
strncpy_loop:
lodsb
stosb
test al, al
jz strncpy_exit
loop strncpy_loop
xor al, al ;add \0 at the end
stosb
strncpy_exit:
pop di si cx ax
ret
;-- vim: set filetype=fasm:

0 comments on commit 8f1194b

Please sign in to comment.