[master] Fixed coverity issue in dhcrelay

    Merges in rt41708

diff --git a/RELNOTES b/RELNOTES
index 7e43510cbe0ca35370ba04dd99cb8419ee5fc146..91f926be45a9500475e1aaffacff4764117c91db 100644 (file)
--- a/RELNOTES
+++ b/RELNOTES
@@ -217,6 +217,7 @@ by Eric Young (eay@cryptsoft.com).
   suboption to the agent option added for clients directly connected to the
   relay.
   [ISC-Bugs #34875]
+  [ISC-Bugs #41708]
 
 - Add a new global DHCPv6 option, dhcpv6-set-tee-times, which when enabled
   instructs the server to calculate T1 and T2 as recommended in RFC 3315,

diff --git a/relay/dhcrelay.c b/relay/dhcrelay.c
index 88a0b47ab855978c20f52cb768550da07abd3a13..d6085c98eea0413373683dac94a0b4e15c94f960 100644 (file)
--- a/relay/dhcrelay.c
+++ b/relay/dhcrelay.c
@@ -101,7 +101,7 @@ struct server_list {
        struct sockaddr_in to;
 } *servers;
 
-struct interface_info *uplink;
+struct interface_info *uplink = NULL;
 
 #ifdef DHCPv6
 struct stream_list {
@@ -377,14 +377,27 @@ main(int argc, char **argv) {
                        if (++i == argc)
                                usage(use_noarg, argv[i-1]);
 
+                       if (uplink) {
+                               usage("more than one uplink (-u) specified: %s"
+                                     ,argv[i]);
+                       }
+
                        /* Allocate the uplink interface */
                        status = interface_allocate(&uplink, MDL);
                        if (status != ISC_R_SUCCESS) {
                                log_fatal("%s: uplink interface_allocate: %s",
                                         argv[i], isc_result_totext(status));
                        }
+               
+                       if (strlen(argv[i]) >= sizeof(uplink->name)) {
+                               log_fatal("%s: uplink name too long,"
+                                         " it cannot exceed: %ld characters",
+                                         argv[i], sizeof(uplink->name) - 1);
+                       }
 
-                       strcpy(uplink->name, argv[i]);
+                       uplink->name[sizeof(uplink->name) - 1] = 0x00;
+                       strncpy(uplink->name, argv[i],
+                               sizeof(uplink->name) - 1);
                        interface_snorf(uplink, INTERFACE_REQUESTED);
 
                        /* Turn on -a, in case they don't do so explicitly */