From: Gert Doering Date: Sat, 8 Jun 2019 07:56:22 +0000 (+0200) Subject: Copy one byte less in strncpynt() X-Git-Tag: v2.5_beta1~312 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=bebd25a0e3a2aba0b1f98463a87b24db6c419a66;p=thirdparty%2Fopenvpn.git Copy one byte less in strncpynt() While the existing code is not wrong and will never cause an overflow, it will copy (on a too-long source string) "maxlen" bytes to dest, and then overwrite the last byte just copied with "0" - which causes a warning in gcc 9 about filling the target buffer "up to the end, with no room for a trailing 0 anymore". Reducing the maximum bytes-to-be-copied to "maxlen -1", because the last byte will be stamped with 0 anyway. v2: do not ASSERT() on "maxlen == 0", but move the strncpy() call inside the if() clause - so "just do nothing" on maxlen == 0, as before. Signed-off-by: Gert Doering Acked-by: Antonio Quartulli Message-Id: <20190608075622.11589-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg18502.html Signed-off-by: Gert Doering --- diff --git a/src/openvpn/buffer.h b/src/openvpn/buffer.h index a4fe6f9be..1722ffd50 100644 --- a/src/openvpn/buffer.h +++ b/src/openvpn/buffer.h @@ -347,9 +347,9 @@ buf_set_read(struct buffer *buf, const uint8_t *data, int size) static inline void strncpynt(char *dest, const char *src, size_t maxlen) { - strncpy(dest, src, maxlen); if (maxlen > 0) { + strncpy(dest, src, maxlen-1); dest[maxlen - 1] = 0; } }