From: Eric Sandeen Date: Sat, 26 Jan 2013 22:40:29 +0000 (+0000) Subject: xfs_fsr: guard against path string overflows X-Git-Tag: v3.1.11~15 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=6063fecad207d13981dea3e20f89f7ac4c3fb26f;p=thirdparty%2Fxfsprogs-dev.git xfs_fsr: guard against path string overflows gettmpname() and getparent() blindly copy strings into a target array; be sure we limit the copy to the size of the target and null terminate it. I don't see a way to get here with a too-long name, since most paths try to open or stat the file already, but it can't hurt to be defensive. Signed-off-by: Eric Sandeen Reviewed-by: Mark Tinguely Signed-off-by: Mark Tinguely --- diff --git a/fsr/xfs_fsr.c b/fsr/xfs_fsr.c index 2db222498..843f57d70 100644 --- a/fsr/xfs_fsr.c +++ b/fsr/xfs_fsr.c @@ -1452,7 +1452,8 @@ gettmpname(char *fname) sprintf(sbuf, "/.fsr%d", getpid()); - strcpy(buf, fname); + strncpy(buf, fname, PATH_MAX); + buf[PATH_MAX] = '\0'; ptr = strrchr(buf, '/'); if (ptr) { *ptr = '\0'; @@ -1476,7 +1477,8 @@ getparent(char *fname) static char buf[PATH_MAX+1]; char *ptr; - strcpy(buf, fname); + strncpy(buf, fname, PATH_MAX); + buf[PATH_MAX] = '\0'; ptr = strrchr(buf, '/'); if (ptr) { if (ptr == &buf[0])