A couple of places where a string is overrun. This fixes both of them.

1 files changed, 3 insertions, 2 deletions

diff --git a/noncore/apps/opie-reader/chm_lib.c b/noncore/apps/opie-reader/chm_lib.c
index ecf8278..7acd1d2 100644
--- a/noncore/apps/opie-reader/chm_lib.c
+++ b/noncore/apps/opie-reader/chm_lib.c
@@ -1507,263 +1507,264 @@ int chm_enumerate(struct chmFile *h,
         /* try to fetch the index page */
         if (_chm_fetch_bytes(h,
                              page_buf,
                              (UInt64)h->dir_offset + (UInt64)curPage*h->block_len,
                              h->block_len) != h->block_len)
             return 0;
 
         /* figure out start and end for this page */
         cur = page_buf;
         lenRemain = _CHM_PMGL_LEN;
         if (! _unmarshal_pmgl_header(&cur, &lenRemain, &header))
             return 0;
         end = page_buf + h->block_len - (header.free_space);
 
         /* loop over this page */
         while (cur < end)
         {
             if (! _chm_parse_PMGL_entry(&cur, &ui))
                 return 0;
 
             /* check for DIRS */
             if (ui.length == 0  &&  !(what & CHM_ENUMERATE_DIRS))
                 continue;
 
             /* check for FILES */
             if (ui.length != 0  &&  !(what & CHM_ENUMERATE_FILES))
                 continue;
 
             /* check for NORMAL vs. META */
             if (ui.path[0] == '/')
             {
 
                 /* check for NORMAL vs. SPECIAL */
                 if (ui.path[1] == '#'  ||  ui.path[1] == '$')
                     flag = CHM_ENUMERATE_SPECIAL;
                 else
                     flag = CHM_ENUMERATE_NORMAL;
             }
             else
                 flag = CHM_ENUMERATE_META;
             if (! (what & flag))
                 continue;
 
             /* call the enumerator */
             {
                 int status = (*e)(h, &ui, context);
                 switch (status)
                 {
                     case CHM_ENUMERATOR_FAILURE:  return 0;
                     case CHM_ENUMERATOR_CONTINUE: break;
                     case CHM_ENUMERATOR_SUCCESS:  return 1;
                     default:                      break;
                 }
             }
         }
 
         /* advance to next page */
         curPage = header.block_next;
     }
 
     return 1;
 }
 
 int chm_enumerate_dir(struct chmFile *h,
                       const char *prefix,
                       int what,
                       CHM_ENUMERATOR e,
                       void *context)
 {
     /*
      * XXX: do this efficiently (i.e. using the tree index)
      */
 
     Int32 curPage;
 
     /* buffer to hold whatever page we're looking at */
 #ifdef WIN32
         UChar *page_buf = alloca((unsigned int)h->block_len);
 #else
     UChar page_buf[h->block_len];
 #endif
     struct chmPmglHeader header;
     UChar *end;
     UChar *cur;
     unsigned long lenRemain;
 
     /* set to 1 once we've started */
     int it_has_begun=0;
 
     /* the current ui */
     struct chmUnitInfo ui;
     int flag;
 
     /* the length of the prefix */
     char prefixRectified[CHM_MAX_PATHLEN+1];
     int prefixLen;
-    char lastPath[CHM_MAX_PATHLEN];
+    char lastPath[CHM_MAX_PATHLEN+1];
     int lastPathLen;
 
     /* starting page */
     curPage = h->index_head;
 
     /* initialize pathname state */
     strncpy(prefixRectified, prefix, CHM_MAX_PATHLEN);
     prefixLen = strlen(prefixRectified);
     if (prefixLen != 0)
     {
         if (prefixRectified[prefixLen-1] != '/')
         {
             prefixRectified[prefixLen] = '/';
             prefixRectified[prefixLen+1] = '\0';
             ++prefixLen;
         }
     }
     lastPath[0] = '\0';
     lastPathLen = -1;
 
     /* until we have either returned or given up */
     while (curPage != -1)
     {
 
         /* try to fetch the index page */
         if (_chm_fetch_bytes(h,
                              page_buf,
                              (UInt64)h->dir_offset + (UInt64)curPage*h->block_len,
                              h->block_len) != h->block_len)
             return 0;
 
         /* figure out start and end for this page */
         cur = page_buf;
         lenRemain = _CHM_PMGL_LEN;
         if (! _unmarshal_pmgl_header(&cur, &lenRemain, &header))
             return 0;
         end = page_buf + h->block_len - (header.free_space);
 
         /* loop over this page */
         while (cur < end)
         {
             if (! _chm_parse_PMGL_entry(&cur, &ui))
                 return 0;
 
             /* check if we should start */
             if (! it_has_begun)
             {
                 if (ui.length == 0  &&  strncmp(ui.path, prefixRectified, prefixLen) == 0)
                     it_has_begun = 1;
                 else
                     continue;
 
                 if (ui.path[prefixLen] == '\0')
                     continue;
             }
 
             /* check if we should stop */
             else
             {
                 if (strncmp(ui.path, prefixRectified, prefixLen) != 0)
                     return 1;
             }
 
             /* check if we should include this path */
             if (lastPathLen != -1)
             {
                 if (strncmp(ui.path, lastPath, lastPathLen) == 0)
                     continue;
             }
-            strcpy(lastPath, ui.path);
+            strncpy(lastPath, ui.path, CHM_MAX_PATHLEN);
+            lastPath[CHM_MAX_PATHLEN] = '\0';
             lastPathLen = strlen(lastPath);
 
             /* check for DIRS */
             if (ui.length == 0  &&  !(what & CHM_ENUMERATE_DIRS))
                 continue;
 
             /* check for FILES */
             if (ui.length != 0  &&  !(what & CHM_ENUMERATE_FILES))
                 continue;
 
             /* check for NORMAL vs. META */
             if (ui.path[0] == '/')
             {
 
                 /* check for NORMAL vs. SPECIAL */
                 if (ui.path[1] == '#'  ||  ui.path[1] == '$')
                     flag = CHM_ENUMERATE_SPECIAL;
                 else
                     flag = CHM_ENUMERATE_NORMAL;
             }
             else
                 flag = CHM_ENUMERATE_META;
             if (! (what & flag))
                 continue;
 
             /* call the enumerator */
             {
                 int status = (*e)(h, &ui, context);
                 switch (status)
                 {
                     case CHM_ENUMERATOR_FAILURE:  return 0;
                     case CHM_ENUMERATOR_CONTINUE: break;
                     case CHM_ENUMERATOR_SUCCESS:  return 1;
                     default:                      break;
                 }
             }
         }
 
         /* advance to next page */
         curPage = header.block_next;
     }
 
     return 1;
 }
 
 /* resolve a particular object from the archive */
 int chm_resolve_location(struct chmFile *h,
                          unsigned long pos,
                          struct chmUnitInfo *ui)
 {
   /*
    * XXX: implement caching scheme for dir pages
    */
 
   Int32 curPage;
 
   /* buffer to hold whatever page we're looking at */
 #ifdef WIN32
   UChar *page_buf = alloca(h->block_len);
 #else
   UChar page_buf[h->block_len];
 #endif
 
   /* starting page */
   curPage = h->index_root;
 
   /* until we have either returned or given up */
   while (curPage != -1)
     {
 
       /* try to fetch the index page */
       if (_chm_fetch_bytes(h, page_buf,
                            (UInt64)h->dir_offset + (UInt64)curPage*h->block_len,
                            h->block_len) != h->block_len)
         return CHM_RESOLVE_FAILURE;
 
       /* now, if it is a leaf node: */
       if (memcmp(page_buf, _chm_pmgl_marker, 4) == 0)
         {
           /* scan block */
                   /*  UChar *pEntry = _chm_find_in_PMGL(page_buf, h->block_len, objPath);*/
           {
             /* XXX: modify this to do a binary search using the nice index structure
              *      that is provided for us.
              */
             struct chmPmglHeader header;
             UInt32 hremain;
             UChar *end;
             UChar *cur;
             UChar *temp;
 /*

             UInt64 strLen;
             char buffer[CHM_MAX_PATHLEN+1];
 */
             /* figure out where to start and end */
             cur = page_buf;