Fixed an evil bug where rawname() could write across the boundaries of

an array. The bug became obvious in the old system where the array was only
32 characters long (now MAXPATHLEN). Dump honored its name then (:-)
and dumped its core when calling dump -w for a fstab that contained rather long
NFS file system names. Even though this is rather unlikely to happen now,
a bug is a bug:)

1 files changed, 3 insertions, 3 deletions

diff --git a/sbin/dump/main.c b/sbin/dump/main.c
index 40d668e..db7c41c 100644
--- a/sbin/dump/main.c
+++ b/sbin/dump/main.c
@@ -537,10 +537,10 @@ rawname(cp)
 	if (dp == NULL)
 		return (NULL);
 	*dp = '\0';
-	(void)strcpy(rawbuf, cp);
+	(void)strncpy(rawbuf, cp, MAXPATHLEN - 1);
 	*dp = '/';
-	(void)strcat(rawbuf, "/r");
-	(void)strcat(rawbuf, dp + 1);
+	(void)strncat(rawbuf, "/r", strlen(rawbuf) - (MAXPATHLEN - 1));
+	(void)strncat(rawbuf, dp + 1, strlen(rawbuf) - (MAXPATHLEN - 1));
 	return (rawbuf);
 }