Change the last strcpy calls to strlcpy.

diff --git a/dhcp6.c b/dhcp6.c
index 7bff0b7b84402fc12fa145e0811cfb8345b9169a..eab245401ee2825052a90872fffb13ef89a63403 100644 (file)
--- a/dhcp6.c
+++ b/dhcp6.c
@@ -2750,7 +2750,7 @@ dhcp6_env(char **env, const char *prefix, const struct interface *ifp,
        const struct if_options *ifo;
        struct dhcp_opt *opt, *vo;
        const struct dhcp6_option *o;
-       size_t i, n;
+       size_t i, l, n;
        uint16_t ol, oc;
        char *v, *val, *pfx;
        const struct ipv6_addr *ap;
@@ -2849,40 +2849,46 @@ dhcp6_env(char **env, const char *prefix, const struct interface *ifp,
        if (TAILQ_FIRST(&state->addrs)) {
                if (env) {
                        if (ifo->ia_type == D6_OPTION_IA_PD) {
-                               i = strlen(prefix) +
+                               l = strlen(prefix) +
                                    strlen("_dhcp6_prefix=");
                                TAILQ_FOREACH(ap, &state->addrs, next) {
-                                       i += strlen(ap->saddr) + 1;
+                                       l += strlen(ap->saddr) + 1;
                                }
-                               v = val = env[n] = malloc(i);
+                               v = val = env[n] = malloc(l);
                                if (v == NULL) {
                                        syslog(LOG_ERR, "%s: %m", __func__);
                                        return -1;
                                }
-                               v += snprintf(val, i, "%s_dhcp6_prefix=",
-                                       prefix);
+                               i = snprintf(val, l, "%s_dhcp6_prefix=",
+                                   prefix);
+                               v += i;
+                               l -= i;
                                TAILQ_FOREACH(ap, &state->addrs, next) {
-                                       strcpy(v, ap->saddr);
-                                       v += strlen(ap->saddr);
+                                       i = strlen(ap->saddr);
+                                       strlcpy(v, ap->saddr, l);
+                                       v += i;
+                                       l -= i;
                                        *v++ = ' ';
                                }
                                *--v = '\0';
                        } else {
-                               i = strlen(prefix) +
+                               l = strlen(prefix) +
                                    strlen("_dhcp6_ip_address=");
                                TAILQ_FOREACH(ap, &state->addrs, next) {
-                                       i += strlen(ap->saddr) + 1;
+                                       l += strlen(ap->saddr) + 1;
                                }
-                               v = val = env[n] = malloc(i);
+                               v = val = env[n] = malloc(l);
                                if (v == NULL) {
                                        syslog(LOG_ERR, "%s: %m", __func__);
                                        return -1;
                                }
-                               v += snprintf(val, i, "%s_dhcp6_ip_address=",
-                                       prefix);
+                               i = snprintf(val, l, "%s_dhcp6_ip_address=",
+                                   prefix);
                                TAILQ_FOREACH(ap, &state->addrs, next) {
-                                       strcpy(v, ap->saddr);
-                                       v += strlen(ap->saddr);
+                                       i = strlen(ap->saddr);
+                                       strlcpy(v, ap->saddr, l);
+                                       v += i;
+                                       l -= i;
                                        *v++ = ' ';
                                }
                                *--v = '\0';

diff --git a/ipv6nd.c b/ipv6nd.c
index aec50c480145cf133a6b9e023faca990605b316c..3a182a429a99fcb6d9abdee614d2d2993a242997 100644 (file)
--- a/ipv6nd.c
+++ b/ipv6nd.c
@@ -857,13 +857,13 @@ ipv6nd_handlera(struct ipv6_ctx *ctx, struct interface *ifp,
                            ntohl(pi->nd_opt_pi_preferred_time);
                        ap->nsprobes = 0;
                        if (opt) {
-                               l = strlen(opt);
-                               tmp = realloc(opt,
-                                       l + strlen(ap->saddr) + 2);
+                               l = strlen(opt) + 1;
+                               m = strlen(ap->saddr) + 1;
+                               tmp = realloc(opt, l + m);
                                if (tmp) {
                                        opt = tmp;
-                                       opt[l] = ' ';
-                                       strcpy(opt + l + 1, ap->saddr);
+                                       opt[l - 1] = ' ';
+                                       strlcpy(opt + l, ap->saddr, m);
                                }
                        } else
                                opt = strdup(ap->saddr);
@@ -1129,24 +1129,25 @@ ipv6nd_env(char **env, const char *prefix, const struct interface *ifp)
                                        if (new) {
                                                **var = new;
                                                new = strchr(**var, '=');
-                                               if (new)
-                                                       strcpy(new + 1,
-                                                           rao->option);
-                                               else
+                                               if (new) {
+                                                       len -= (new - **var);
+                                                       strlcpy(new + 1,
+                                                           rao->option,
+                                                           len - 1);
+                                               } else
                                                        syslog(LOG_ERR,
                                                            "new is null");
                                        }
                                        continue;
                                }
-                               new = realloc(**var,
-                                   strlen(**var) + 1 +
-                                   strlen(rao->option) + 1);
+                               len = strlen(rao->option) + 1;
+                               new = realloc(**var, strlen(**var) + 1 + len);
                                if (new == NULL)
                                        return -1;
                                **var = new;
                                new += strlen(new);
                                *new++ = ' ';
-                               strcpy(new, rao->option);
+                               strlcpy(new, rao->option, len);
                                continue;
                        }
                        if (env) {

diff --git a/platform-bsd.c b/platform-bsd.c
index f6088f8c0233b5def79ccf6deed863937cad4358..d6c90ed3954c6aa7d8a598b4fd31548588b89025 100644 (file)
--- a/platform-bsd.c
+++ b/platform-bsd.c
@@ -114,7 +114,7 @@ ipv6_ra_flush(void)
        s = socket(AF_INET6, SOCK_DGRAM, 0);
        if (s == -1)
                return -1;
-       strcpy(dummy, "lo0");
+       strlcpy(dummy, "lo0", sizeof(dummy));
        if (ioctl(s, SIOCSRTRFLUSH_IN6, (caddr_t)&dummy) == -1)
                syslog(LOG_ERR, "SIOSRTRFLUSH_IN6: %m");
        if (ioctl(s, SIOCSPFXFLUSH_IN6, (caddr_t)&dummy) == -1)