server: fix potential buffer overrun in bind string

[fio.git] / server.c

diff --git a/server.c b/server.c
index 73866d770e3f3dc7722bec9434f70b054cd5e1cb..9442764ed609a4d52ea472ef844a93f8f7dcbb45 100644 (file)
--- a/server.c
+++ b/server.c
@@ -1095,18 +1095,19 @@ static void convert_dus(struct disk_util_stat *dst, struct disk_util_stat *src)
 {
        int i;
 
-       strcpy((char *) dst->name, (char *) src->name);
+       dst->name[FIO_DU_NAME_SZ - 1] = '\0';
+       strncpy((char *) dst->name, (char *) src->name, FIO_DU_NAME_SZ - 1);
 
        for (i = 0; i < 2; i++) {
-               dst->ios[i]     = cpu_to_le32(src->ios[i]);
-               dst->merges[i]  = cpu_to_le32(src->merges[i]);
-               dst->sectors[i] = cpu_to_le64(src->sectors[i]);
-               dst->ticks[i]   = cpu_to_le32(src->ticks[i]);
+               dst->s.ios[i]           = cpu_to_le32(src->s.ios[i]);
+               dst->s.merges[i]        = cpu_to_le32(src->s.merges[i]);
+               dst->s.sectors[i]       = cpu_to_le64(src->s.sectors[i]);
+               dst->s.ticks[i]         = cpu_to_le32(src->s.ticks[i]);
        }
 
-       dst->io_ticks           = cpu_to_le32(src->io_ticks);
-       dst->time_in_queue      = cpu_to_le32(src->time_in_queue);
-       dst->msec               = cpu_to_le64(src->msec);
+       dst->s.io_ticks         = cpu_to_le32(src->s.io_ticks);
+       dst->s.time_in_queue    = cpu_to_le32(src->s.time_in_queue);
+       dst->s.msec             = cpu_to_le64(src->s.msec);
 }
 
 void fio_server_send_du(void)
@@ -1367,6 +1368,8 @@ static int fio_init_server_connection(void)
        if (sk < 0)
                return sk;
 
+       memset(bind_str, 0, sizeof(bind_str));
+
        if (!bind_sock) {
                char *p, port[16];
                const void *src;
@@ -1386,9 +1389,9 @@ static int fio_init_server_connection(void)
                if (p)
                        strcat(p, port);
                else
-                       strcpy(bind_str, port);
+                       strncpy(bind_str, port, sizeof(bind_str) - 1);
        } else
-               strcpy(bind_str, bind_sock);
+               strncpy(bind_str, bind_sock, sizeof(bind_str) - 1);
 
        log_info("fio: server listening on %s\n", bind_str);