chage: Replace STRFCPY() by STRLCPY()

The variables are only being read as strings (char *), so data after the
'\0' can't be leaked.

Cc: Christian Göttsche <cgzones@googlemail.com>
Cc: Serge Hallyn <serge@hallyn.com>
Cc: Iker Pedrosa <ipedrosa@redhat.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

diff --git a/src/chage.c b/src/chage.c
index b8a11e8c4a61a6bbb7683c0f87220aa57cdaf771..6896cb15a3e5e54dcec457653a7d53826757dd7a 100644 (file)
--- a/src/chage.c
+++ b/src/chage.c
@@ -33,6 +33,7 @@
 #include "pwio.h"
 #include "shadowio.h"
 #include "shadowlog.h"
+#include "strlcpy.h"
 #ifdef WITH_TCB
 #include "tcbfuncs.h"
 #endif
@@ -822,7 +823,7 @@ int main (int argc, char **argv)
                fail_exit (E_NOPERM);
        }
 
-       STRFCPY (user_name, pw->pw_name);
+       STRLCPY(user_name, pw->pw_name);
 #ifdef WITH_TCB
        if (shadowtcb_set_user (pw->pw_name) == SHADOWTCB_FAILURE) {
                fail_exit (E_NOPERM);