From dd1f7b6438fd6a472eabb84d7053e05dfb869343 Mon Sep 17 00:00:00 2001 From: imp Date: Fri, 18 Jul 1997 18:52:53 +0000 Subject: Add code to make sure that we don't overflow the buffer that we copy the hostname into. In theory the bind library should do this, but in practice the limites between system defines and bind defines make an attack using this vector possible. These patches have been in use on my systems for three months now, so I am fairly confident about them. I plan on commiting this to 2.2 and 2.1 in the near future, as well as many other patches of this nature. --- usr.sbin/lpr/common_source/common.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'usr.sbin/lpr/common_source') diff --git a/usr.sbin/lpr/common_source/common.c b/usr.sbin/lpr/common_source/common.c index 9b9244e..9f1ee41 100644 --- a/usr.sbin/lpr/common_source/common.c +++ b/usr.sbin/lpr/common_source/common.c @@ -307,7 +307,10 @@ checkremote() "unable to get official name for local machine %s", name); return errbuf; - } else (void) strcpy(name, hp->h_name); + } else { + (void) strncpy(name, hp->h_name, sizeof(name)); + name[sizeof(name) - 1] = '\0'; + } /* get the official name of RM */ hp = gethostbyname(RM); -- cgit v1.1