Fix another buffer overflow.

PR:		15593
Submitted by:	Przemyslaw Frasunek <venglin@lagoon.FreeBSD.lublin.pl>

2 files changed, 12 insertions, 6 deletions

diff --git a/usr.bin/doscmd/cwd.c b/usr.bin/doscmd/cwd.c
index ef5635f..f7fea8e 100644
--- a/usr.bin/doscmd/cwd.c
+++ b/usr.bin/doscmd/cwd.c
@@ -225,12 +225,12 @@ dos_makepath(u_char *where, u_char *newpath)
 
     np = newpath;
     if (*where != '\\' && *where != '/') {
-	ustrcpy(tmppath, d->cwd);
+	ustrncpy(tmppath, d->cwd, 1024);
 	if (d->cwd[1])
-	    ustrcat(tmppath, (u_char *)"/");
-	ustrcat(tmppath, where);
+	    ustrncat(tmppath, (u_char *)"/", 1024 - ustrlen(tmppath));
+	ustrncat(tmppath, where, 1024 - ustrlen(tmppath));
     } else {
-	ustrcpy(tmppath, where);
+	ustrncpy(tmppath, where, 1024 - ustrlen(tmppath));
     }
 
     dirs = get_entries(tmppath);
diff --git a/usr.bin/doscmd/cwd.h b/usr.bin/doscmd/cwd.h
index dfe7e4e..10d97bf 100644
--- a/usr.bin/doscmd/cwd.h
+++ b/usr.bin/doscmd/cwd.h
@@ -45,7 +45,13 @@ ustrcat(u_char *s1, u_char *s2)
 }
 
 static inline u_char *
-ustrncpy(u_char *s1, u_char *s2, unsigned n)
+ustrncat(u_char *s1, u_char *s2, size_t n)
+{
+    return((u_char *)strncat((char *)s1, (char *)s2, n));
+}
+
+static inline u_char *
+ustrncpy(u_char *s1, u_char *s2, size_t n)
 {
     return((u_char *)strncpy((char *)s1, (char *)s2, n));
 }
@@ -57,7 +63,7 @@ ustrcmp(u_char *s1, u_char *s2)
 }
 
 static inline int
-ustrncmp(u_char *s1, u_char *s2, unsigned n)
+ustrncmp(u_char *s1, u_char *s2, size_t n)
 {
     return(strncmp((char *)s1, (char *)s2, n));
 }