1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51
|
Description: Make sure setting and reading CRC do not work past buffer size.
The code used to store 8 bytes in a 4 byte space, and read 8 bytes from a 4
byte space on 64 bit platforms. Rewrite to use int32_t to ensure only 4
bytes are used.
Author: Petter Reinholdtsen <pere@debian.org>
Bug-Debian: https://bugs.debian.org/576520
Forwarded: no
Last-Update: 2024-06-15
---
--- cdbackup-0.7.1.orig/cdbackup.c
+++ cdbackup-0.7.1/cdbackup.c
@@ -29,6 +29,7 @@ SUCH DAMAGE.
#include <stdlib.h>
#include <stdio.h>
#include <stdarg.h>
+#include <stdint.h>
#include <unistd.h>
#include <fcntl.h>
#include <string.h>
@@ -392,8 +393,8 @@ int backup(void)
}
}
if(crc) {
- int l=crc32(buffer,bytes+DBSIZE);
- *((unsigned long *)(&buffer[CD_FRAMESIZE-4]))=l;
+ int32_t l=crc32(buffer,bytes+DBSIZE);
+ *((int32_t *)(&buffer[CD_FRAMESIZE-sizeof(l)]))=l;
}
Vwrite(buffer); grandTotal+=CD_FRAMESIZE;
} while(db->status==0);
--- cdbackup-0.7.1.orig/cdrestore.c
+++ cdbackup-0.7.1/cdrestore.c
@@ -28,6 +28,7 @@ SUCH DAMAGE.
#include <stdio.h>
#include <stdlib.h>
+#include <stdint.h>
#include <string.h>
#include <unistd.h>
#include <time.h>
@@ -203,8 +204,8 @@ int restore(int disktrack)
}
if(db->flags&F_CRC) {
- int l=crc32(buffer,size+DBSIZE);
- if(*((unsigned long *)(&buffer[CD_FRAMESIZE-4]))!=l) {
+ int32_t l=crc32(buffer,size+DBSIZE);
+ if(*((int32_t *)(&buffer[CD_FRAMESIZE-sizeof(l)]))!=l) {
if(verbose) fprintf(stderr,"%s: bad CRC checksum at %lld\n",prg_name,totalRead);
serror("Bad checksum, block corrupted, restore failed");
}
|