From 7f0d0b55f2c60bf46b9a1ecfa77f5f83d1cf17fa Mon Sep 17 00:00:00 2001 From: "Darrick J. Wong" Date: Fri, 26 Apr 2019 15:44:21 -0500 Subject: [PATCH] misc: fix strncpy length complaints Fix a number of complaints about feeding sizeof(dest) directly to strncpy. We do this by feeding strncpy the length of the buffer minus one, having checked that the allocated space are long enough. Signed-off-by: Darrick J. Wong Reviewed-by: Bill O'Donnell Reviewed-by: Eric Sandeen Signed-off-by: Eric Sandeen --- mkfs/xfs_mkfs.c | 13 +++++++++++-- quota/edit.c | 9 ++++++--- 2 files changed, 17 insertions(+), 5 deletions(-) diff --git a/mkfs/xfs_mkfs.c b/mkfs/xfs_mkfs.c index 3e2ef92d8..db3ad38ea 100644 --- a/mkfs/xfs_mkfs.c +++ b/mkfs/xfs_mkfs.c @@ -3270,8 +3270,17 @@ finish_superblock_setup( struct xfs_mount *mp, struct xfs_sb *sbp) { - if (cfg->label) - strncpy(sbp->sb_fname, cfg->label, sizeof(sbp->sb_fname)); + if (cfg->label) { + size_t label_len; + + /* + * Labels are null terminated unless the string fits exactly + * in the label field, so assume sb_fname is zeroed and then + * do a memcpy because the destination isn't a normal C string. + */ + label_len = min(sizeof(sbp->sb_fname), strlen(cfg->label)); + memcpy(sbp->sb_fname, cfg->label, label_len); + } sbp->sb_dblocks = cfg->dblocks; sbp->sb_rblocks = cfg->rtblocks; diff --git a/quota/edit.c b/quota/edit.c index b10a5b34d..f9938b8ac 100644 --- a/quota/edit.c +++ b/quota/edit.c @@ -368,8 +368,7 @@ restore_file( uint type) { char buffer[512]; - char devbuffer[512]; - char *dev = NULL; + char dev[512]; uint mask; int cnt; uint32_t id; @@ -377,7 +376,11 @@ restore_file( while (fgets(buffer, sizeof(buffer), fp) != NULL) { if (strncmp("fs = ", buffer, 5) == 0) { - dev = strncpy(devbuffer, buffer+5, sizeof(devbuffer)); + /* + * Copy the device name to dev, strip off the trailing + * newline, and move on to the next line. + */ + strncpy(dev, buffer + 5, sizeof(dev) - 1); dev[strlen(dev) - 1] = '\0'; continue; } -- 2.47.2