Fix minor buffer problems:
Off by one in verify allowed one to march one byte off the end of wd.wd_hostname if wd.wd_hostname had no NUL characters in it. strncpy of myname into mywd used the source buffer's length, rather than the dest.
This commit is contained in:
parent
c293d821b3
commit
471595b02c
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=19303
@ -223,7 +223,8 @@ usage: fprintf(stderr, "usage: rwhod [ -m [ ttl ] ]\n");
|
||||
}
|
||||
if ((cp = index(myname, '.')) != NULL)
|
||||
*cp = '\0';
|
||||
strncpy(mywd.wd_hostname, myname, sizeof(myname) - 1);
|
||||
strncpy(mywd.wd_hostname, myname, sizeof(mywd.wd_hostname) - 1);
|
||||
mywd.wd_hostname[sizeof(mywd.wd_hostname) - 1] = '\0';
|
||||
utmpf = open(_PATH_UTMP, O_RDONLY|O_CREAT, 0644);
|
||||
if (utmpf < 0) {
|
||||
syslog(LOG_ERR, "%s: %m", _PATH_UTMP);
|
||||
@ -351,7 +352,7 @@ verify(name, maxlen)
|
||||
{
|
||||
register int size = 0;
|
||||
|
||||
while (*name && size < maxlen) {
|
||||
while (*name && size < maxlen - 1) {
|
||||
if (!isascii(*name) || !(isalnum(*name) || ispunct(*name)))
|
||||
return (0);
|
||||
name++, size++;
|
||||
|
Loading…
Reference in New Issue
Block a user