fix strncpy(3) copy length

0 terminate the last byte, and copy at most size-1.
(or 0 terminate the last byte after copying upto size bytes)

Signed-off-by: Tomohiro Kusumi <tkusumi@tuxera.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/os/windows/posix.c b/os/windows/posix.c
index 488d0ed2c44e16bd1bd82c447b9affb67e567987..00f03355985077c08665a79e5036b60755507e40 100755 (executable)
--- a/os/windows/posix.c
+++ b/os/windows/posix.c
@@ -584,7 +584,8 @@ char *basename(char *path)
        while (path[i] != '\\' && path[i] != '/' && i >= 0)
                i--;
 
-       strncpy(name, path + i + 1, MAX_PATH);
+       name[MAX_PATH - 1] = '\0';
+       strncpy(name, path + i + 1, MAX_PATH - 1);
 
        return name;
 }

diff --git a/server.c b/server.c
index 0469cea7221f063c26fcc0526cc6a2f8928ae873..e6ea4cdbfdcabc911a97f0e96d1e99e92b8c520b 100644 (file)
--- a/server.c
+++ b/server.c
@@ -856,7 +856,7 @@ static int handle_probe_cmd(struct fio_net_cmd *cmd)
 #ifdef CONFIG_BIG_ENDIAN
        probe.bigendian = 1;
 #endif
-       strncpy((char *) probe.fio_version, fio_version_string, sizeof(probe.fio_version));
+       strncpy((char *) probe.fio_version, fio_version_string, sizeof(probe.fio_version) - 1);
 
        probe.os        = FIO_OS;
        probe.arch      = FIO_ARCH;