From: Alejandro Colomar <alx@kernel.org>
Date: Sat, 29 Jul 2023 15:28:23 +0000 (+0200)
Subject: sulogin: Replace STRFCPY() by STRLCPY()
X-Git-Tag: 4.15.0-rc1~195
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=3e0913f11923edca6999d8682b18ad2b3579bfd1;p=thirdparty%2Fshadow.git

sulogin: Replace STRFCPY() by STRLCPY()

The variable is only being read as a string (char *), so data after the
'\0' can't be leaked.

Cc: Christian Göttsche <cgzones@googlemail.com>
Cc: Serge Hallyn <serge@hallyn.com>
Cc: Iker Pedrosa <ipedrosa@redhat.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
---

diff --git a/src/sulogin.c b/src/sulogin.c
index 7f2d86955..386493d16 100644
--- a/src/sulogin.c
+++ b/src/sulogin.c
@@ -24,6 +24,7 @@
 /*@-exitarg@*/
 #include "exitcodes.h"
 #include "shadowlog.h"
+#include "strlcpy.h"
 
 /*
  * Global variables
@@ -157,7 +158,7 @@ static void catch_signals (unused int sig)
 #endif
 			exit (0);
 		}
-		STRFCPY (pass, cp);
+		STRLCPY(pass, cp);
 		erase_pass (cp);
 
 		if (valid (pass, &pwent)) {	/* check encrypted passwords ... */