From: Pierre Schweitzer <pierre@reactos.org>
Date: Wed, 22 Dec 2010 00:13:03 +0000 (+0000)
Subject: [FASTFAT]
X-Git-Tag: backups/ros-branch-0_3_13@51035~326
X-Git-Url: https://git.reactos.org/?p=reactos.git;a=commitdiff_plain;h=10bab368705c76a295fe039bed3cad871da77f4c

[FASTFAT]
Fix for a buffer overflow and then a buffer overrun (if ever it fixes something)
The way filenames are handled for FAT entries should be REALLY simplified. This would prevent such errors.
Thus, there are more magic values in fastfat driver than everywhere else in ReactOS which makes proper fixing hard (impossible?).
Finally, the code for that fix is crappy, but I don't care, it fits the rest of the fastfat driver code.
*pissed off*
Fixes CID #2502

svn path=/trunk/; revision=50090
---

diff --git a/reactos/drivers/filesystems/fastfat/volume.c b/reactos/drivers/filesystems/fastfat/volume.c
index 4a014b37882..6fd04800e5f 100644
--- a/reactos/drivers/filesystems/fastfat/volume.c
+++ b/reactos/drivers/filesystems/fastfat/volume.c
@@ -220,8 +220,16 @@ FsdSetFsLabelInformation(PDEVICE_OBJECT DeviceObject,
   }
   else
   {
-    RtlCopyMemory(VolumeLabelDirEntry.Fat.Filename, cString, LabelLen);
-    memset(&VolumeLabelDirEntry.Fat.Filename[LabelLen], ' ', 11 - LabelLen);
+    RtlCopyMemory(VolumeLabelDirEntry.Fat.Filename, cString, max(sizeof(VolumeLabelDirEntry.Fat.Filename), LabelLen));
+    if (LabelLen > sizeof(VolumeLabelDirEntry.Fat.Filename))
+    {
+      memset(VolumeLabelDirEntry.Fat.Ext, ' ', sizeof(VolumeLabelDirEntry.Fat.Ext));
+      RtlCopyMemory(VolumeLabelDirEntry.Fat.Ext, cString + sizeof(VolumeLabelDirEntry.Fat.Filename), LabelLen - sizeof(VolumeLabelDirEntry.Fat.Filename));
+    }
+    else
+    {
+      memset(&VolumeLabelDirEntry.Fat.Filename[LabelLen], ' ', sizeof(VolumeLabelDirEntry.Fat.Filename) - LabelLen);
+    }
     VolumeLabelDirEntry.Fat.Attrib = 0x08;
   }