Address some security concerns in the cgpt tool.

cgpt/cmd_add.c

 // Copyright (c) 2010 The Chromium OS Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "cgpt.h"
 
 #include <getopt.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
@@ skipping 18 matching lines @@
          "  -A NUM       set raw 64-bit attribute value\n"
          "\n"
          "Use the -i option to modify an existing partition.\n"
          "The -b, -s, and -t options must be given for new partitions.\n"
          "\n", progname);
   PrintTypes();
 }
 
 int cmd_add(int argc, char *argv[]) {
   struct drive drive;
-  int partition = 0;
+  uint32_t partition = 0;
   uint64_t begin = 0;
   uint64_t size = 0;
   Guid type_guid;
   Guid unique_guid;
   char *label = 0;
   int successful = 0;
   int tries = 0;
   int priority = 0;
   uint16_t raw_value = 0;
   int set_begin = 0;
   int set_size = 0;
   int set_type = 0;
   int set_unique = 0;
   int set_successful = 0;
   int set_tries = 0;
   int set_priority = 0;
   int set_raw = 0;
 
   int gpt_retval;
   GptEntry *entry;
-  int index;
-  
+  uint32_t index;
+
   int c;
   int errorcnt = 0;
   char *e = 0;
 
   opterr = 0;                     // quiet, you
   while ((c=getopt(argc, argv, ":hi:b:s:t:u:l:S:T:P:A:")) != -1)
   {
     switch (c)
     {
     case 'i':
@@ skipping 119 matching lines @@
 
   if (CGPT_OK != DriveOpen(argv[optind], &drive))
     return CGPT_FAILED;
 
   if (GPT_SUCCESS != (gpt_retval = GptSanityCheck(&drive.gpt))) {
     Error("GptSanityCheck() returned %d: %s\n",
           gpt_retval, GptError(gpt_retval));
     return CGPT_FAILED;
   }
 
-  int max_part = GetNumberOfEntries(&drive.gpt);
+  uint32_t max_part = GetNumberOfEntries(&drive.gpt);
   if (partition) {
     if (partition > max_part) {
       Error("invalid partition number: %d\n", partition);
       goto bad;
     }
     index = partition - 1;
     entry = GetEntry(&drive.gpt, PRIMARY, index);
   } else {
     // find next empty partition
     for (index = 0; index < max_part; index++) {
@@ skipping 25 matching lines @@
 
   if (set_begin)
     entry->starting_lba = begin;
   if (set_size)
     entry->ending_lba = begin + size - 1;
   if (set_type)
     memcpy(&entry->type, &type_guid, sizeof(Guid));
   if (set_unique)
     memcpy(&entry->unique, &unique_guid, sizeof(Guid));
   if (label) {
-    uint16_t buf[128];
-    UTF8ToUTF16((uint8_t *)label, buf);
-    memcpy(entry->name, buf, sizeof(entry->name));
+    UTF8ToUTF16((uint8_t *)label, entry->name,
+                sizeof(entry->name) / sizeof(entry->name[0]));
   }
   if (set_raw) {
     entry->attrs.fields.gpt_att = raw_value;
   } else {
     if (set_successful)
       SetSuccessful(&drive.gpt, PRIMARY, index, successful);
     if (set_tries)
       SetTries(&drive.gpt, PRIMARY, index, tries);
     if (set_priority)
       SetPriority(&drive.gpt, PRIMARY, index, priority);
   }
 
   RepairEntries(&drive.gpt, MASK_PRIMARY);
   RepairHeader(&drive.gpt, MASK_PRIMARY);
 
   drive.gpt.modified |= (GPT_MODIFIED_HEADER1 | GPT_MODIFIED_ENTRIES1 |
                          GPT_MODIFIED_HEADER2 | GPT_MODIFIED_ENTRIES2);
   UpdateCrc(&drive.gpt);
 
 
   // Write it all out
   return DriveClose(&drive, 1);
 
 bad:
   (void) DriveClose(&drive, 0);
   return CGPT_FAILED;
 }