test/librbd/fsx.c: fix potential unterminated string handling

In case of strncpy() make sure string is '\0' terminated. Before
usage of strcat() check if the destination has enough free space
to concat the char and to terminate the string to prevent illegal
memory access.

Fix for:

CID 1219459 (2 of 2): Buffer not null terminated (BUFFER_SIZE_WARNING)
 buffer_size_warning: Calling strncpy with a maximum size argument of
 1024 bytes on destination array goodfile of size 1024 bytes might
 leave the destination string unterminated.

Signed-off-by: Danny Al-Gaaf <danny.al-gaaf@bisect.de>

diff --git a/src/test/librbd/fsx.c b/src/test/librbd/fsx.c
index 38ae4ccb75f2a6a992116d1cf3230cf7a7960ff0..182e6426ffa676c8930f773a292dc54c247231da 100644 (file)
--- a/src/test/librbd/fsx.c
+++ b/src/test/librbd/fsx.c
@@ -2069,11 +2069,23 @@ main(int argc, char **argv)
                        randomoplen = 0;
                        break;
                case 'P':
-                       strncpy(dirpath, optarg, sizeof(dirpath));
-                       strncpy(goodfile, dirpath, sizeof(goodfile));
-                       strcat(goodfile, "/");
+                       strncpy(dirpath, optarg, sizeof(dirpath)-1);
+                       dirpath[sizeof(dirpath)-1] = '\0';
+                       strncpy(goodfile, dirpath, sizeof(goodfile)-1);
+                       goodfile[sizeof(goodfile)-1] = '\0';
+                       if (strlen(goodfile) < sizeof(goodfile)-2) {
+                               strcat(goodfile, "/");
+                       } else {
+                               prt("file name to long\n");
+                               exit(1);
+                       }
                        strncpy(logfile, dirpath, sizeof(logfile));
-                       strcat(logfile, "/");
+                       if (strlen(logfile) < sizeof(logfile)-2) {
+                               strcat(logfile, "/");
+                       } else {
+                               prt("file path to long\n");
+                               exit(1);
+                       }
                        break;
                 case 'R':
                         mapped_reads = 0;