setterm: segfault with long dump file name

The patch will make too long path to be truncated to MAX_PATH
lenght. If user supplies too long file name that is caught at
fopen. Some users might find this unintuitive, so the altered
behavior will be mantioned in manual page.

Bug in earlier version was visible with a command bellow.

setterm -dump -file $(for i in $(seq 254); do printf x ; done)

Signed-off-by: Sami Kerola <kerolasa@iki.fi>

diff --git a/term-utils/setterm.c b/term-utils/setterm.c
index 14b2c3df47550fc1aa49a7040b3a507093c47e21..1ced69579113f24eb37482f26c316c5bb78f900b 100644 (file)
--- a/term-utils/setterm.c
+++ b/term-utils/setterm.c
@@ -202,7 +202,7 @@ int opt_tb_array[161];              /* Array for tab list */
 int opt_msglevel_num;
 int opt_ps_mode, opt_pd_min;   /* powersave mode/powerdown time */
 
-char opt_sn_name[200] = "screen.dump";
+char opt_sn_name[PATH_MAX + 1] = "screen.dump";
 
 static void screendump(int vcnum, FILE *F);
 
@@ -525,8 +525,9 @@ parse_snapfile(int argc, char **argv, int *option, int *opt_all, int *bad_arg) {
        if (argc != 1 || *option)
                *bad_arg = TRUE;
        *option = TRUE;
+       memset(opt_all, 0, PATH_MAX + 1);
        if (argc == 1)
-               strcpy((char *)opt_all, argv[0]);
+               strncpy((char *)opt_all, argv[0], PATH_MAX);
 }
 
 static void