From: Alejandro Colomar <alx@kernel.org>
Date: Sat, 29 Jul 2023 16:04:30 +0000 (+0200)
Subject: gpasswd: Replace STRFCPY() by STRLCPY()
X-Git-Tag: 4.15.0-rc1~192
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=7bfcf1724c4885879a3001710c143385140678d5;p=thirdparty%2Fshadow.git

gpasswd: Replace STRFCPY() by STRLCPY()

The variable is only being read as a string (char *), so data after the
'\0' can't be leaked.

Cc: Christian Göttsche <cgzones@googlemail.com>
Cc: Serge Hallyn <serge@hallyn.com>
Cc: Iker Pedrosa <ipedrosa@redhat.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
---

diff --git a/src/gpasswd.c b/src/gpasswd.c
index 12fbc8072..fbf50cbdb 100644
--- a/src/gpasswd.c
+++ b/src/gpasswd.c
@@ -32,8 +32,9 @@
 #endif
 /*@-exitarg@*/
 #include "exitcodes.h"
-
 #include "shadowlog.h"
+#include "strlcpy.h"
+
 /*
  * Global variables
  */
@@ -895,7 +896,7 @@ static void change_passwd (struct group *gr)
 			exit (1);
 		}
 
-		STRFCPY (pass, cp);
+		STRLCPY(pass, cp);
 		erase_pass (cp);
 		cp = agetpass (_("Re-enter new password: "));
 		if (NULL == cp) {