avoid string overflows

Several places using strcpy would benefit from strncpy
for safety.

Signed-off-by: Eric Sandeen <sandeen@redhat.com>
Signed-off-by: Jens Axboe <jaxboe@fusionio.com>

diff --git a/blkparse.c b/blkparse.c
index 80b3a71ad9a2e9112471f3b68e22e47ccfdfddbd..b0b88c394a7e4687c77cb6693ef385cae1c23790 100644 (file)
--- a/blkparse.c
+++ b/blkparse.c
@@ -562,7 +562,9 @@ static struct process_pid_map *add_ppm_hash(pid_t pid, const char *name)
                ppm = malloc(sizeof(*ppm));
                memset(ppm, 0, sizeof(*ppm));
                ppm->pid = pid;
-               strcpy(ppm->comm, name);
+               memset(ppm->comm, 0, sizeof(ppm->comm));
+               strncpy(ppm->comm, name, sizeof(ppm->comm));
+               ppm->comm[sizeof(ppm->comm) - 1] = '\0';
                ppm->hash_next = ppm_hash_table[hash_idx];
                ppm_hash_table[hash_idx] = ppm;
        }

diff --git a/blktrace.c b/blktrace.c
index 563f908ddbbb3cc35a081d0a0467cd29ed335bd8..89aaaac227bc2d3ed4a03f61a71e8396a2cc6f72 100644 (file)
--- a/blktrace.c
+++ b/blktrace.c
@@ -872,8 +872,9 @@ static int net_send_header(int fd, int cpu, char *buts_name, int len)
        memset(&hdr, 0, sizeof(hdr));
 
        hdr.magic = BLK_IO_TRACE_MAGIC;
+       memset(hdr.buts_name, 0, sizeof(hdr.buts_name));
        strncpy(hdr.buts_name, buts_name, sizeof(hdr.buts_name));
-       hdr.buts_name[sizeof(hdr.buts_name)-1] = '\0';
+       hdr.buts_name[sizeof(hdr.buts_name) - 1] = '\0';
        hdr.cpu = cpu;
        hdr.max_cpus = ncpus;
        hdr.len = len;
@@ -981,7 +982,9 @@ retry:
                }
 
                memcpy(&addr->sin_addr, hent->h_addr, 4);
-               strcpy(hostname, hent->h_name);
+               memset(hostname, 0, sizeof(hostname));
+               strncpy(hostname, hent->h_name, sizeof(hostname));
+               hostname[sizeof(hostname) - 1] = '\0';
        }
 
        return 0;
@@ -2131,7 +2134,9 @@ static int handle_args(int argc, char *argv[])
                        break;
                case 'h':
                        net_mode = Net_client;
-                       strcpy(hostname, optarg);
+                       memset(hostname, 0, sizeof(hostname));
+                       strncpy(hostname, optarg, sizeof(hostname));
+                       hostname[sizeof(hostname) - 1] = '\0';
                        break;
                case 'l':
                        net_mode = Net_server;