misc: use strncpy to prevent buffer overflow

diff --git a/src/client/Client.cc b/src/client/Client.cc
index 3a660e036649a9b2771e41c8b5c71da02379f64c..464714ee32aa993d320340edeeff7a609bf1ef6a 100644 (file)
--- a/src/client/Client.cc
+++ b/src/client/Client.cc
@@ -4239,7 +4239,8 @@ void Client::seekdir(dir_result_t *dirp, loff_t offset)
 //};
 void Client::fill_dirent(struct dirent *de, const char *name, int type, uint64_t ino, loff_t next_off)
 {
-  strncpy(de->d_name, name, 256);
+  strncpy(de->d_name, name, 255);
+  de->d_name[255] = '\0';
 #ifndef __CYGWIN__
   de->d_ino = ino;
 #ifndef DARWIN

diff --git a/src/crushtool.cc b/src/crushtool.cc
index 06429363f0ce0a0e84f5ac9ceedcb806b5784c81..61aaa1eaebf659fc5029889d106f24fe3ad70d86 100644 (file)
--- a/src/crushtool.cc
+++ b/src/crushtool.cc
@@ -1114,10 +1114,11 @@ int main(int argc, const char **argv)
        rootid = id;
 
        char format[20];
+       format[sizeof(format)-1] = '\0';
        if (l.size)
-         snprintf(format, sizeof(format), "%s%%d", l.name);
+         snprintf(format, sizeof(format)-1, "%s%%d", l.name);
        else
-         strcpy(format, l.name);
+         strncpy(format, l.name, sizeof(format)-1);
        char name[20];
        snprintf(name, sizeof(name), format, i);
        crush.set_item_name(id, name);

diff --git a/src/os/FileStore.cc b/src/os/FileStore.cc
index 6cbc27697f099bc9cd4586d7d74c590785904ca6..79d254bd8a5105548f14636deabc8ae692e38c7b 100644 (file)
--- a/src/os/FileStore.cc
+++ b/src/os/FileStore.cc
@@ -750,7 +750,7 @@ int FileStore::wipe_subvol(const char *s)
 {
   struct btrfs_ioctl_vol_args volargs;
   memset(&volargs, 0, sizeof(volargs));
-  strcpy(volargs.name, s);
+  strncpy(volargs.name, s, sizeof(volargs.name)-1);
   int fd = ::open(basedir.c_str(), O_RDONLY);
   if (fd < 0) {
     int err = errno;