o MAXPATHLEN is the correct constant to use for path names, it includes

  the NULL.
o use snprintf in preference to unchecked strcat in a couple of places that
  likely can't overflow.  Makes it easier to grep for strcpy :-)

2 files changed, 13 insertions, 19 deletions

diff --git a/libexec/xtend/user.c b/libexec/xtend/user.c
index 1200dd9..e10445e 100644
--- a/libexec/xtend/user.c
+++ b/libexec/xtend/user.c
@@ -59,7 +59,7 @@ user_command(void)
   char h;
   char *m;
   int i, k, n, error;
-  char cmd[512], dumppath[MAXPATHLEN+1], pkt[3];
+  char cmd[512], dumppath[MAXPATHLEN], pkt[3];
   FILE *dumpf;
 
   error = 0;
@@ -89,9 +89,7 @@ user_command(void)
 	fprintf(User, "OK\n");
       }
     } else if(!strcmp("dump\n", cmd)) {
-      strcpy(dumppath, X10DIR);
-      strcat(dumppath, "/");
-      strcat(dumppath, X10DUMPNAME);
+      snprintf(dumppath, sizeof(dumppath), "%s/%s" X10DIR, X10DUMPNAME);
       if((dumpf = fopen(dumppath, "w")) != NULL) {
 	for(h = 0; h < 16; h++) {
 	  for(i = 0; i < 16; i++) {
diff --git a/libexec/xtend/xtend.c b/libexec/xtend/xtend.c
index c36aa88..9e5ed4f 100644
--- a/libexec/xtend/xtend.c
+++ b/libexec/xtend/xtend.c
@@ -90,10 +90,10 @@ int user_command(void);
 int
 main(int argc, char *argv[])
 {
-  const char *twpath = TWPATH;
-  const char *sockpath = SOCKPATH;
-  char logpath[MAXPATHLEN+1];
-  char statpath[MAXPATHLEN+1];
+  char *twpath = TWPATH;
+  char *sockpath = SOCKPATH;
+  char logpath[MAXPATHLEN];
+  char statpath[MAXPATHLEN];
   struct sockaddr_un sa;
   struct timeval tv;
   struct passwd *pw;
@@ -119,16 +119,14 @@ main(int argc, char *argv[])
   /*
    * Open the log file before doing anything else
    */
-  strcpy(logpath, X10DIR);
-  if(stat(logpath, &sb) == -1 && errno == ENOENT) {
-    if(mkdir(logpath, 0755) != -1) {
-      chown(logpath, pw->pw_uid, gr->gr_gid);
+  if(stat(X10DIR, &sb) == -1 && errno == ENOENT) {
+    if(mkdir(X10DIR, 0755) != -1) {
+      chown(X10DIR, pw->pw_uid, gr->gr_gid);
     } else {
-      errx(1, "can't create directory '%s'", logpath);
+      errx(1, "can't create directory '%s'", X10DIR);
     }
   }
-  strcat(logpath, "/");
-  strcat(logpath, X10LOGNAME);
+  snprintf(logpath, sizeof(logpath), "%s/%s" X10DIR, X10LOGNAME);
   if((Log = fopen(logpath, "a")) == NULL)
     errx(1, "can't open log file '%s'", logpath);
   chown(logpath, pw->pw_uid, gr->gr_gid);
@@ -361,13 +359,11 @@ onpipe(int signo)
 void
 dohup(void)
 {
-  char logpath[MAXPATHLEN+1];
+  char logpath[MAXPATHLEN];
 
   fprintf(Log, "%s:  SIGHUP received, reopening Log\n", thedate());
   fclose(Log);
-  strcpy(logpath, X10DIR);
-  strcat(logpath, "/");
-  strcat(logpath, X10LOGNAME);
+  snprintf(logpath, sizeof(logpath), "%s/%s" X10DIR, X10LOGNAME);
   if((Log = fopen(logpath, "a")) == NULL)
     errx(1, "can't open log file '%s'", logpath);
   hup_flag = 0;