fix a buffer overflow

[libpicofe.git] / menu.c

diff --git a/menu.c b/menu.c
index eb728da..2447bce 100644 (file)
--- a/menu.c
+++ b/menu.c
@@ -239,7 +239,7 @@ static char tolower_simple(char c)
 \r
 void menu_init_base(void)\r
 {\r
-       int i, c, l;\r
+       int i, c, l, pos;\r
        unsigned char *fd, *fds;\r
        char buff[256];\r
        FILE *f;\r
@@ -252,7 +252,7 @@ void menu_init_base(void)
                return;\r
 \r
        // generate default 8x10 font from fontdata8x8\r
-       for (c = 0, fd = menu_font_data; c < 256; c++)\r
+       for (c = 0, fd = menu_font_data; c < 128; c++)\r
        {\r
                for (l = 0; l < 8; l++)\r
                {\r
@@ -294,17 +294,18 @@ void menu_init_base(void)
        }\r
 \r
        // load custom font and selector (stored as 1st symbol in font table)\r
-       emu_make_path(buff, "skin/font.png", sizeof(buff));\r
+       pos = plat_get_skin_dir(buff, sizeof(buff));\r
+       strcpy(buff + pos, "font.png");\r
        readpng(menu_font_data, buff, READPNG_FONT,\r
                MENU_X2 ? 256 : 128, MENU_X2 ? 320 : 160);\r
        // default selector symbol is '>'\r
        memcpy(menu_font_data, menu_font_data + ((int)'>') * me_mfont_w * me_mfont_h / 2,\r
                me_mfont_w * me_mfont_h / 2);\r
-       emu_make_path(buff, "skin/selector.png", sizeof(buff));\r
+       strcpy(buff + pos, "selector.png");\r
        readpng(menu_font_data, buff, READPNG_SELECTOR, me_mfont_w, me_mfont_h);\r
 \r
        // load custom colors\r
-       emu_make_path(buff, "skin/skin.txt", sizeof(buff));\r
+       strcpy(buff + pos, "skin.txt");\r
        f = fopen(buff, "r");\r
        if (f != NULL)\r
        {\r
@@ -959,9 +960,11 @@ static int dirent_seek_char(struct dirent **namelist, int len, int sel, char c)
        int i;\r
 \r
        sel++;\r
-       for (i = sel + 1; i != sel; i++) {\r
+       for (i = sel + 1; ; i++) {\r
                if (i >= len)\r
                        i = 1;\r
+               if (i == sel)\r
+                       break;\r
 \r
                if (tolower_simple(namelist[i]->d_name[0]) == c)\r
                        break;\r