Corrected possible buffer overruns in included programs and examples.

Corrected possible buffer overruns in included programs and examples.
Reported by Pedro Ribeiro <pedrib@gmail.com>.

diff --git a/doc/examples/ex-cert-select-pkcs11.c b/doc/examples/ex-cert-select-pkcs11.c
index fb902be891ecb56a3f9f0960f1c14c5e3b751df1..5aaba6d30998214427ec48bd0915a52e8fc24d7e 100644 (file)
--- a/doc/examples/ex-cert-select-pkcs11.c
+++ b/doc/examples/ex-cert-select-pkcs11.c
@@ -63,7 +63,7 @@ pin_callback (void *user, int attempt, const char *token_url,
       exit (1);
     }
 
-  len = MIN (pin_max, strlen (password));
+  len = 1 + MIN (pin_max, strlen (password));
   memcpy (pin, password, len);
   pin[len] = 0;
 

diff --git a/src/common.c b/src/common.c
index cdbb25219ad81f0a94d54962873ecb3afa414c16..d4331f842866b215fc2993e825f4f8e068bb7d3c 100644 (file)
--- a/src/common.c
+++ b/src/common.c
@@ -1045,12 +1045,19 @@ pin_callback (void *user, int attempt, const char *token_url,
       exit (1);
     }
 
-  len = MIN (pin_max, strlen (password));
+  len = 1 + MIN (pin_max, strlen (password));
   memcpy (pin, password, len);
   pin[len] = 0;
 
   /* cache */
-  strcpy (cached_pin, pin);
+  if (len < sizeof(cached_pin))
+    {
+      memcpy (cached_pin, pin, len);
+      cached_pin[len] = 0;
+    }
+  else
+    cached_pin[0] = 0;
+
   free (cached_url);
   if (token_url)
     cached_url = strdup (token_url);

diff --git a/src/psk.c b/src/psk.c
index beb872c3f3915b2a144a5f6fe6f1b85156da9e95..51bba1c0864e7c346dee75b324c5d30de3643125 100644 (file)
--- a/src/psk.c
+++ b/src/psk.c
@@ -204,13 +204,13 @@ write_key (const char *username, const char *key, int key_size,
   FILE *fd2;
   int put;
 
-  if (strlen (passwd_file) > sizeof (tmpname) + 5)
+  if (strlen (passwd_file) + 5 > sizeof (tmpname))
     {
       fprintf (stderr, "file '%s' is tooooo long\n", passwd_file);
       return -1;
     }
-  strcpy (tmpname, passwd_file);
-  strcat (tmpname, ".tmp");
+
+  snprintf (tmpname, sizeof(tmpname), "%s.tmp", passwd_file);
 
   if (stat (tmpname, &st) != -1)
     {

diff --git a/src/srptool.c b/src/srptool.c
index f50264cc9155b6b823c47d726ef8bc7f783a8ce3..5fcd17eaab0c3c953ec0d0a6d0a5fa751fa33966 100644 (file)
--- a/src/srptool.c
+++ b/src/srptool.c
@@ -602,13 +602,13 @@ crypt_int (const char *username, const char *passwd, int salt_size,
       FILE *fd2;
       int put;
 
-      if (strlen (tpasswd) > sizeof (tmpname) + 5)
+      if (strlen (tpasswd) + 5 > sizeof (tmpname))
         {
           fprintf (stderr, "file '%s' is tooooo long\n", tpasswd);
           return -1;
         }
-      strcpy (tmpname, tpasswd);
-      strcat (tmpname, ".tmp");
+
+      snprintf(tmpname, sizeof(tmpname), "%s.tmp", tpasswd);
 
       if (stat (tmpname, &st) != -1)
         {