xfsprogs: libxcmd: avoid using strtok()

The strtok() library routine overwrites delimiting bytes in the
string it is supplied.  It is also not length-constrained.

Since we're making a duplicate of the string anyway, and since we
are only finding the end of a single token, we can do both without
the need to modify the passed-in mount entry structure.

Add checking for memory allocation failures, and if one occurs just
exit (as is the practice elsewhere in this file).

Signed-off-by: Alex Elder <aelder@sgi.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>

diff --git a/libxcmd/paths.c b/libxcmd/paths.c
index ae9db32f975cddfa9a75e0be3afca27f84c93bf8..ed931101d97b9ce78a9c06ddc7c6e72d11b090ce 100644 (file)
--- a/libxcmd/paths.c
+++ b/libxcmd/paths.c
@@ -216,12 +216,21 @@ fs_extract_mount_options(
 
        /* Do this only after we've finished processing mount options */
        if (fslog) {
-               strtok(fslog, " ,");
-               fslog = strdup(fslog);
+               fslog = strndup(fslog, strcspn(fslog, " ,"));
+               if (!fslog) {
+                       fprintf(stderr, _("%s: %s: out of memory (fslog)\n"),
+                                   progname, __func__);
+                       exit(1);
+               }
        }
        if (fsrt) {
-               strtok(fsrt, " ,");
-               fsrt = strdup(fsrt);
+               fsrt = strndup(fsrt, strcspn(fsrt, " ,"));
+               if (!fsrt) {
+                       fprintf(stderr, _("%s: %s: out of memory (fsrt)\n"),
+                                   progname, __func__);
+                       free(fslog);
+                       exit(1);
+               }
        }
 
        *logp = fslog;