From: Roy Marples <roy@marples.name>
Date: Thu, 6 Mar 2014 09:12:06 +0000 (+0000)
Subject: Change the last strcpy calls to strlcpy.
X-Git-Tag: v6.3.2~30
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=3af8f2b277ae8a4ebef590531d56a3d14a689ee5;p=thirdparty%2Fdhcpcd.git

Change the last strcpy calls to strlcpy.
---

diff --git a/dhcp6.c b/dhcp6.c
index 7bff0b7b..eab24540 100644
--- a/dhcp6.c
+++ b/dhcp6.c
@@ -2750,7 +2750,7 @@ dhcp6_env(char **env, const char *prefix, const struct interface *ifp,
 	const struct if_options *ifo;
 	struct dhcp_opt *opt, *vo;
 	const struct dhcp6_option *o;
-	size_t i, n;
+	size_t i, l, n;
 	uint16_t ol, oc;
 	char *v, *val, *pfx;
 	const struct ipv6_addr *ap;
@@ -2849,40 +2849,46 @@ dhcp6_env(char **env, const char *prefix, const struct interface *ifp,
 	if (TAILQ_FIRST(&state->addrs)) {
 		if (env) {
 			if (ifo->ia_type == D6_OPTION_IA_PD) {
-				i = strlen(prefix) +
+				l = strlen(prefix) +
 				    strlen("_dhcp6_prefix=");
 				TAILQ_FOREACH(ap, &state->addrs, next) {
-					i += strlen(ap->saddr) + 1;
+					l += strlen(ap->saddr) + 1;
 				}
-				v = val = env[n] = malloc(i);
+				v = val = env[n] = malloc(l);
 				if (v == NULL) {
 					syslog(LOG_ERR, "%s: %m", __func__);
 					return -1;
 				}
-				v += snprintf(val, i, "%s_dhcp6_prefix=",
-					prefix);
+				i = snprintf(val, l, "%s_dhcp6_prefix=",
+				    prefix);
+				v += i;
+				l -= i;
 				TAILQ_FOREACH(ap, &state->addrs, next) {
-					strcpy(v, ap->saddr);
-					v += strlen(ap->saddr);
+					i = strlen(ap->saddr);
+					strlcpy(v, ap->saddr, l);
+					v += i;
+					l -= i;
 					*v++ = ' ';
 				}
 				*--v = '\0';
 			} else {
-				i = strlen(prefix) +
+				l = strlen(prefix) +
 				    strlen("_dhcp6_ip_address=");
 				TAILQ_FOREACH(ap, &state->addrs, next) {
-					i += strlen(ap->saddr) + 1;
+					l += strlen(ap->saddr) + 1;
 				}
-				v = val = env[n] = malloc(i);
+				v = val = env[n] = malloc(l);
 				if (v == NULL) {
 					syslog(LOG_ERR, "%s: %m", __func__);
 					return -1;
 				}
-				v += snprintf(val, i, "%s_dhcp6_ip_address=",
-					prefix);
+				i = snprintf(val, l, "%s_dhcp6_ip_address=",
+				    prefix);
 				TAILQ_FOREACH(ap, &state->addrs, next) {
-					strcpy(v, ap->saddr);
-					v += strlen(ap->saddr);
+					i = strlen(ap->saddr);
+					strlcpy(v, ap->saddr, l);
+					v += i;
+					l -= i;
 					*v++ = ' ';
 				}
 				*--v = '\0';
diff --git a/ipv6nd.c b/ipv6nd.c
index aec50c48..3a182a42 100644
--- a/ipv6nd.c
+++ b/ipv6nd.c
@@ -857,13 +857,13 @@ ipv6nd_handlera(struct ipv6_ctx *ctx, struct interface *ifp,
 			    ntohl(pi->nd_opt_pi_preferred_time);
 			ap->nsprobes = 0;
 			if (opt) {
-				l = strlen(opt);
-				tmp = realloc(opt,
-					l + strlen(ap->saddr) + 2);
+				l = strlen(opt) + 1;
+				m = strlen(ap->saddr) + 1;
+				tmp = realloc(opt, l + m);
 				if (tmp) {
 					opt = tmp;
-					opt[l] = ' ';
-					strcpy(opt + l + 1, ap->saddr);
+					opt[l - 1] = ' ';
+					strlcpy(opt + l, ap->saddr, m);
 				}
 			} else
 				opt = strdup(ap->saddr);
@@ -1129,24 +1129,25 @@ ipv6nd_env(char **env, const char *prefix, const struct interface *ifp)
 					if (new) {
 						**var = new;
 						new = strchr(**var, '=');
-						if (new)
-							strcpy(new + 1,
-							    rao->option);
-						else
+						if (new) {
+							len -= (new - **var);
+							strlcpy(new + 1,
+							    rao->option,
+							    len - 1);
+						} else
 							syslog(LOG_ERR,
 							    "new is null");
 					}
 					continue;
 				}
-				new = realloc(**var,
-				    strlen(**var) + 1 +
-				    strlen(rao->option) + 1);
+				len = strlen(rao->option) + 1;
+				new = realloc(**var, strlen(**var) + 1 + len);
 				if (new == NULL)
 					return -1;
 				**var = new;
 				new += strlen(new);
 				*new++ = ' ';
-				strcpy(new, rao->option);
+				strlcpy(new, rao->option, len);
 				continue;
 			}
 			if (env) {
diff --git a/platform-bsd.c b/platform-bsd.c
index f6088f8c..d6c90ed3 100644
--- a/platform-bsd.c
+++ b/platform-bsd.c
@@ -114,7 +114,7 @@ ipv6_ra_flush(void)
 	s = socket(AF_INET6, SOCK_DGRAM, 0);
 	if (s == -1)
 		return -1;
-	strcpy(dummy, "lo0");
+	strlcpy(dummy, "lo0", sizeof(dummy));
 	if (ioctl(s, SIOCSRTRFLUSH_IN6, (caddr_t)&dummy) == -1)
 		syslog(LOG_ERR, "SIOSRTRFLUSH_IN6: %m");
 	if (ioctl(s, SIOCSPFXFLUSH_IN6, (caddr_t)&dummy) == -1)