# Null terminated string can be overwritten with a length prefixed string if
# its writable and contains at least one unused byte.
	.section	.text
	.intel_syntax
	.global	strcpyz
	.type	strcpyz, @function
strcpyz:
	push	%ebp
	mov	%ebp, %esp
	push	%esi
	push	%edi
	push	[%ebp + 12]
	call	strlen
	add	%esp, 4			# Deallocate space
	cmp	%eax, 255
	jbe	strcpyz.copy_string	# 255 >= length
	mov	%eax, 255		# length = 255
strcpyz.copy_string:
	mov	%ecx, %eax		# length
	mov	%esi, [%ebp + 12]	# source
	add	%esi, %ecx		# %esi = source + length
	mov	%edi, [%ebp + 8]	# destination
	add	%ecx, 1			# %ecx = length + 1
	add	%edi, %ecx		# %edi = destination + %ecx
	mov	byte ptr [%edi], 0
	std				# Set DF for down-memory write
	rep	movsb			# Blast the string into the buffer
	mov	%edx, [%ebp + 16]	# length
	mov	%eax, [%ebp + 8]	# destination
	mov	[%eax], %dl		# destination, dereferenced = length
	pop	%edi
	pop	%esi
	pop	%ebp
	ret
