Corrected pathname buffer size handling in the `dpp` utility.
authorArto Bendiken <arto@bendiken.net>
Tue, 14 Oct 2014 22:13:13 +0000 (22:13 +0000)
committerArto Bendiken <arto@bendiken.net>
Tue, 14 Oct 2014 22:13:59 +0000 (22:13 +0000)
This resolves CID 66412 (Buffer not null terminated).
Note, however, that BUFSIZ should probably be PATH_MAX instead.

src/c/dpp.c

index c38a7ac..3dfabc4 100755 (executable)
@@ -904,7 +904,8 @@ main(int argc, char **argv)
          strcpy(filename, "-");
        } else {
          in = fopen(argv[1],"r");
-         strncpy(filename, argv[1], BUFSIZ);
+         strncpy(filename, argv[1], BUFSIZ-1);
+         filename[BUFSIZ-1] = '\0';
        }
 #ifdef _MSC_VER
        /* Convert all backslashes in filename into slashes,
@@ -916,10 +917,11 @@ main(int argc, char **argv)
 #endif
        if (argc < 3 || !strcmp(argv[2],"-")) {
          out = stdout;
-         strncpy(outfile, "-", BUFSIZ);
+         strcpy(outfile, "-");
        } else {
          out = fopen(argv[2],"w");
-         strncpy(outfile, argv[2], BUFSIZ);
+         strncpy(outfile, argv[2], BUFSIZ-1);
+         outfile[BUFSIZ-1] = '\0';
        }
        if (in == NULL)
                error("can't open input file");