[CRIU] [PATCH] lib: don't copy more than the buffer size

Andrey Vagin avagin at openvz.org
Fri Dec 20 13:20:48 PST 2013


CID 1141012 (#1 of 1): Copy into fixed size buffer (STRING_OVERFLOW)
2. fixed_size_dest: You might overrun the 108 byte fixed-size string
"addr.sun_path" by copying "service_address" without checking the
length.

Signed-off-by: Andrey Vagin <avagin at openvz.org>
---
 lib/criu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/criu.c b/lib/criu.c
index d3ab3ee..f0feba3 100644
--- a/lib/criu.c
+++ b/lib/criu.c
@@ -161,7 +161,7 @@ static int criu_connect(void)
 	memset(&addr, 0, sizeof(addr));
 	addr.sun_family = AF_LOCAL;
 
-	strcpy(addr.sun_path, service_address);
+	strncpy(addr.sun_path, service_address, sizeof(addr.sun_path));
 
 	addr_len = strlen(addr.sun_path) + sizeof(addr.sun_family);
 
-- 
1.8.3.1



More information about the CRIU mailing list