mig_strncpy: ensure destination string is null terminated

Message-ID: <xaqw66fuawxm5hzgjscfg2oyp6lxflm5tnbb7u253pw3gmdy4m@5z42mw2qz2l2>

diff --git a/mach/mig_strncpy.c b/mach/mig_strncpy.c
index b0c001d7756f0a5df55983ac7cb4b2d16cf38331..dbd0a08e5691d394f3582f379b0e36118d457b2f 100644 (file)
--- a/mach/mig_strncpy.c
+++ b/mach/mig_strncpy.c
@@ -6,6 +6,14 @@
 vm_size_t
 __mig_strncpy (char *dst, const char *src, vm_size_t len)
 {
-  return __stpncpy (dst, src, len) - dst;
+  if (len == 0)
+    return 0;
+
+  char *end = __stpncpy (dst, src, len - 1);
+  vm_size_t ret = end - dst;
+  /* Null terminate the string.  */
+  if (ret == len - 1)
+    *end = '\0';
+  return ret;
 }
 weak_alias (__mig_strncpy, mig_strncpy)