Add code to make sure that we don't overflow the buffer that we copy

the hostname into.  In theory the bind library should do this, but
in practice the limites between system defines and bind defines make
an attack using this vector possible.  These patches have been in
use on my systems for three months now, so I am fairly confident about
them.  I plan on commiting this to 2.2 and 2.1 in the near future,
as well as many other patches of this nature.

1 files changed, 4 insertions, 1 deletions

diff --git a/usr.sbin/lpr/common_source/common.c b/usr.sbin/lpr/common_source/common.c
index 9b9244e..9f1ee41 100644
--- a/usr.sbin/lpr/common_source/common.c
+++ b/usr.sbin/lpr/common_source/common.c
@@ -307,7 +307,10 @@ checkremote()
 			"unable to get official name for local machine %s",
 			name);
 		    return errbuf;
-		} else (void) strcpy(name, hp->h_name);
+		} else {
+		    (void) strncpy(name, hp->h_name, sizeof(name));
+		    name[sizeof(name) - 1] = '\0';
+		}
 
 		/* get the official name of RM */
 		hp = gethostbyname(RM);