Fix filename buffer overflow in create_filename
FILE_NAME is a fixed 48-byte buffer, but the loop copying the filename parsed from the download URL had no length check, so a filename longer than 48 characters would overflow into adjacent variables (FILE_INI, DIR_zifi, DIR_download, DIR_date). Bound the copy loop to 48 bytes. Verified on hardware via a temporary diagnostic test (since removed): folder/file creation with long names and write+read-back through the FAT32 driver both work correctly, and downloads/<date> is confirmed write-only (playback/viewing always reads from memory, never disk). Documented the fix in README.md.
This commit is contained in:
@@ -157,17 +157,18 @@ create_filename ; and check extension for scl scr sxg others
|
||||
dec hl
|
||||
jr 1b
|
||||
1
|
||||
inc hl
|
||||
inc hl
|
||||
ld de,FILE_NAME ; file_name create
|
||||
ld b,48 ; FILE_NAME is exactly 48 bytes - never write past it
|
||||
2 ld a,(hl)
|
||||
cp ' '
|
||||
jr z,1f
|
||||
ld (de),a
|
||||
inc hl
|
||||
inc de
|
||||
jr 2b
|
||||
djnz 2b ; ran out of room - stop here and null-terminate below
|
||||
|
||||
1
|
||||
1
|
||||
xor a
|
||||
ld (de),a
|
||||
|
||||
|
||||
Reference in New Issue
Block a user