Date: Tue, 22 Jan 2013 22:41:12 +0000 (UTC) From: Baptiste Daroussin <bapt@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r245828 - head/usr.sbin/pkg_install/lib Message-ID: <201301222241.r0MMfCEY043440@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: bapt Date: Tue Jan 22 22:41:12 2013 New Revision: 245828 URL: http://svnweb.freebsd.org/changeset/base/245828 Log: Use snprintf instead of strc* functions and add bounds checking when creating pkgngpath Submitted by: sbz, gahr Modified: head/usr.sbin/pkg_install/lib/lib.h head/usr.sbin/pkg_install/lib/pkgng.c Modified: head/usr.sbin/pkg_install/lib/lib.h ============================================================================== --- head/usr.sbin/pkg_install/lib/lib.h Tue Jan 22 22:31:38 2013 (r245827) +++ head/usr.sbin/pkg_install/lib/lib.h Tue Jan 22 22:41:12 2013 (r245828) @@ -99,7 +99,7 @@ * Version of the package tools - increase whenever you make a change * in the code that is not cosmetic only. */ -#define PKG_INSTALL_VERSION 20121109 +#define PKG_INSTALL_VERSION 20130122 #define PKG_WRAPCONF_FNAME "/var/db/pkg_install.conf" #define main(argc, argv) real_main(argc, argv) Modified: head/usr.sbin/pkg_install/lib/pkgng.c ============================================================================== --- head/usr.sbin/pkg_install/lib/pkgng.c Tue Jan 22 22:31:38 2013 (r245827) +++ head/usr.sbin/pkg_install/lib/pkgng.c Tue Jan 22 22:41:12 2013 (r245828) @@ -38,9 +38,10 @@ this system."; void warnpkgng(void) { - char pkgngpath[MAXPATHLEN]; + char pkgngpath[MAXPATHLEN + 1]; char *pkgngdir; char *dontwarn; + int rc; dontwarn = getenv("PKG_OLD_NOWARN"); if (dontwarn != NULL) @@ -48,8 +49,12 @@ void warnpkgng(void) pkgngdir = getenv("PKG_DBDIR"); if (pkgngdir == NULL) pkgngdir = "/var/db/pkg"; - strcpy(pkgngpath, pkgngdir); - strcat(pkgngpath, "/local.sqlite"); + + rc = snprintf(pkgngpath, sizeof(pkgngpath) "%s/local.sqlite", pkgngdir); + if (rc >= sizeof(pkgngpath)) { + warnx("path too long: %s/local.sqlite", pkgngdir); + return; + } if (access(pkgngpath, F_OK) == 0) warnx(message);
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201301222241.r0MMfCEY043440>