[lxc-devel] [lxc/master] secure coding: strcpy => strlcpy

[2xsec on Github]

A non-text attachment was scrubbed...
Name: not available
Type: text/x-mailbox
Size: 489 bytes
Desc: not available
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20180615/f3387f5a/attachment.bin>
-------------- next part --------------
From 1da4b10ad0e25769c3e239f7b1bc195a70d8bf71 Mon Sep 17 00:00:00 2001
From: Donghwa Jeong <dh48.jeong at samsung.com>
Date: Fri, 15 Jun 2018 19:32:19 +0900
Subject: [PATCH] secure coding: strcpy => strlcpy

Signed-off-by: Donghwa Jeong <dh48.jeong at samsung.com>
---
 src/lxc/criu.c          | 2 +-
 src/lxc/lxccontainer.c  | 5 +++--
 src/lxc/start.c         | 2 +-
 src/lxc/storage/btrfs.c | 8 ++++----
 4 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/src/lxc/criu.c b/src/lxc/criu.c
index 155e69f86..9ccd9b2e5 100644
--- a/src/lxc/criu.c
+++ b/src/lxc/criu.c
@@ -923,7 +923,7 @@ static bool restore_net_info(struct lxc_container *c)
 			if (!lxc_mkifname(template))
 				goto out_unlock;
 
-			strcpy(netdev->priv.veth_attr.veth1, template);
+			(void)strlcpy(netdev->priv.veth_attr.veth1, template, IFNAMSIZ);
 		}
 	}
 
diff --git a/src/lxc/lxccontainer.c b/src/lxc/lxccontainer.c
index de4a49e62..39ac4e691 100644
--- a/src/lxc/lxccontainer.c
+++ b/src/lxc/lxccontainer.c
@@ -1192,7 +1192,8 @@ static int do_create_container_dir(const char *path, struct lxc_conf *conf)
 
 	len = strlen(path);
 	p = alloca(len + 1);
-	strcpy(p, path);
+	(void)strlcpy(p, path, len + 1);
+
 	if (!lxc_list_empty(&conf->id_map)) {
 		ret = chown_mapped_root(p, conf);
 		if (ret < 0)
@@ -4773,7 +4774,7 @@ struct lxc_container *lxc_container_new(const char *name, const char *configpath
 		fprintf(stderr, "Failed to allocate memory for %s\n", name);
 		goto err;
 	}
-	strcpy(c->name, name);
+	(void)strlcpy(c->name, name, strlen(name)+1);
 
 	c->numthreads = 1;
 	c->slock = lxc_newlock(c->config_path, name);
diff --git a/src/lxc/start.c b/src/lxc/start.c
index 9477f2ce4..f6cfc6031 100644
--- a/src/lxc/start.c
+++ b/src/lxc/start.c
@@ -110,7 +110,7 @@ static void print_top_failing_dir(const char *path)
 
 	len = strlen(path);
 	copy = alloca(len + 1);
-	strcpy(copy, path);
+	(void)strlcpy(copy, path, len + 1);
 	p = copy;
 	e = copy + len;
 	while (p < e) {
diff --git a/src/lxc/storage/btrfs.c b/src/lxc/storage/btrfs.c
index f22c41747..31a5705f8 100644
--- a/src/lxc/storage/btrfs.c
+++ b/src/lxc/storage/btrfs.c
@@ -88,8 +88,8 @@ char *get_btrfs_subvol_path(int fd, u64 dir_id, u64 objid, char *name,
 		retpath = malloc(len);
 		if (!retpath)
 			return NULL;
-		strcpy(retpath, args.name);
-		strcat(retpath, "/");
+		(void)strlcpy(retpath, args.name, len);
+		strncat(retpath, "/", 1);
 		strncat(retpath, name, name_len);
 	} else {
 		/* we're at the root of ref_tree */
@@ -602,7 +602,7 @@ static bool update_tree_node(struct mytree_node *n, u64 id, u64 parent,
 		if (!n->name)
 			return false;
 
-		strcpy(n->name, name);
+		(void)strlcpy(n->name, name, name_len + 1);
 	}
 
 	if (dirname) {
@@ -612,7 +612,7 @@ static bool update_tree_node(struct mytree_node *n, u64 id, u64 parent,
 			return false;
 		}
 
-		strcpy(n->dirname, dirname);
+		(void)strlcpy(n->dirname, dirname, strlen(dirname) + 1);
 	}
 	return true;
 }