diff options
| author | Joerg Wunsch <joerg@FreeBSD.org> | 1994-10-28 17:26:27 +0000 |
|---|---|---|
| committer | Joerg Wunsch <joerg@FreeBSD.org> | 1994-10-28 17:26:27 +0000 |
| commit | 56d5f6db85394110359f54ecdb52f49b572fb956 (patch) | |
| tree | 88cbc7033279f0dcf140b89ccac2ee65ffb91d27 /sbin/dump | |
| parent | 3023486ce7818694210d0550ce25185bfa0c5969 (diff) | |
| download | src-56d5f6db85394110359f54ecdb52f49b572fb956.tar.gz src-56d5f6db85394110359f54ecdb52f49b572fb956.zip | |
Fixed an evil bug where rawname() could write across the boundaries of
an array. The bug became obvious in the old system where the array was only
32 characters long (now MAXPATHLEN). Dump honored its name then (:-)
and dumped its core when calling dump -w for a fstab that contained rather long
NFS file system names. Even though this is rather unlikely to happen now,
a bug is a bug:)
Notes
Notes:
svn path=/head/; revision=3974
Diffstat (limited to 'sbin/dump')
| -rw-r--r-- | sbin/dump/main.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/sbin/dump/main.c b/sbin/dump/main.c index 40d668e13e82..db7c41c98178 100644 --- a/sbin/dump/main.c +++ b/sbin/dump/main.c @@ -537,10 +537,10 @@ rawname(cp) if (dp == NULL) return (NULL); *dp = '\0'; - (void)strcpy(rawbuf, cp); + (void)strncpy(rawbuf, cp, MAXPATHLEN - 1); *dp = '/'; - (void)strcat(rawbuf, "/r"); - (void)strcat(rawbuf, dp + 1); + (void)strncat(rawbuf, "/r", strlen(rawbuf) - (MAXPATHLEN - 1)); + (void)strncat(rawbuf, dp + 1, strlen(rawbuf) - (MAXPATHLEN - 1)); return (rawbuf); } |