From: Alan T. DeKok <aland@freeradius.org>
Date: Fri, 24 May 2019 19:45:37 +0000 (-0400)
Subject: check size of buffer.  CID #1445214
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=af6a8b2ac8e8df79b4e66a5a120075685ee3fe00;p=thirdparty%2Ffreeradius-server.git

check size of buffer.  CID #1445214
---

diff --git a/src/modules/rlm_isc_dhcp/rlm_isc_dhcp.c b/src/modules/rlm_isc_dhcp/rlm_isc_dhcp.c
index f80763cb66b..a3b500600ab 100644
--- a/src/modules/rlm_isc_dhcp/rlm_isc_dhcp.c
+++ b/src/modules/rlm_isc_dhcp/rlm_isc_dhcp.c
@@ -1087,7 +1087,7 @@ static int parse_options(rlm_isc_dhcp_info_t *parent, rlm_isc_dhcp_tokenizer_t *
 {
 	int rcode, argc = 0;
 	char *argv[2];
-	char name[256 + 5];
+	char name[FR_DICT_ATTR_MAX_NAME_LEN + 5];
 
 	/*
 	 *	Since read_token() mashes the input buffer, we have to save the tokens somewhere.
@@ -1136,7 +1136,7 @@ static int parse_options(rlm_isc_dhcp_info_t *parent, rlm_isc_dhcp_tokenizer_t *
 		 *	@todo - nuke this extra step once we have dictionary.isc defined.
 		 */
 		memcpy(name, "DHCP-", 5);
-		strcpy(name + 5, argv[0]);
+		strlcpy(name + 5, argv[0], sizeof(name) - 5);
 
 		da = fr_dict_attr_by_name(dict_dhcpv4, name);
 		if (da) {