diff options
author | joerg <joerg@FreeBSD.org> | 1994-10-28 17:26:27 +0000 |
---|---|---|
committer | joerg <joerg@FreeBSD.org> | 1994-10-28 17:26:27 +0000 |
commit | 850e2e306780e10c2fe68cfd24600fcb059f69ee (patch) | |
tree | 88cbc7033279f0dcf140b89ccac2ee65ffb91d27 /sbin/dump | |
parent | 1a6f66b178f67bfc4aa0ac1454311a144a5a00af (diff) | |
download | FreeBSD-src-850e2e306780e10c2fe68cfd24600fcb059f69ee.zip FreeBSD-src-850e2e306780e10c2fe68cfd24600fcb059f69ee.tar.gz |
Fixed an evil bug where rawname() could write across the boundaries of
an array. The bug became obvious in the old system where the array was only
32 characters long (now MAXPATHLEN). Dump honored its name then (:-)
and dumped its core when calling dump -w for a fstab that contained rather long
NFS file system names. Even though this is rather unlikely to happen now,
a bug is a bug:)
Diffstat (limited to 'sbin/dump')
-rw-r--r-- | sbin/dump/main.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/sbin/dump/main.c b/sbin/dump/main.c index 40d668e..db7c41c 100644 --- a/sbin/dump/main.c +++ b/sbin/dump/main.c @@ -537,10 +537,10 @@ rawname(cp) if (dp == NULL) return (NULL); *dp = '\0'; - (void)strcpy(rawbuf, cp); + (void)strncpy(rawbuf, cp, MAXPATHLEN - 1); *dp = '/'; - (void)strcat(rawbuf, "/r"); - (void)strcat(rawbuf, dp + 1); + (void)strncat(rawbuf, "/r", strlen(rawbuf) - (MAXPATHLEN - 1)); + (void)strncat(rawbuf, dp + 1, strlen(rawbuf) - (MAXPATHLEN - 1)); return (rawbuf); } |