util: add bounds check to util_get_{domain,username}

PATCH Applied James Prestwood 2 participants 2 messages Oct 17, 2019

Share & tools

James Prestwood

author

2019-10-17 16:12 UTC #0 lore raw

PATCH v3 1/1 util: add bounds check to util_get_{domain,username}

Two cases were using strcpy, and the other two were using strncpy. Instead all cases can use l_strlcpy which guarentees NULL termination.

---
 src/util.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

src/util.c +4 -4

index f787ce6b..a38dd380 100644
@@ -173,10 +173,10 @@ const char *util_get_domain(const char *identity)
 	for (c = identity; *c; c++) {
 		switch (*c) {
 		case '\\':
-			strncpy(domain, identity, c - identity);
+			memcpy(domain, identity, c - identity);
 			return domain;
 		case '@':
-			strcpy(domain, c + 1);
+			l_strlcpy(domain, c + 1, sizeof(domain));
 			return domain;
 		default:
 			continue;

@@ -197,10 +197,10 @@ const char *util_get_username(const char *identity)
 	for (c = identity; *c; c++) {
 		switch (*c) {
 		case '\\':
-			strcpy(username, c + 1);
+			l_strlcpy(username, c + 1, sizeof(username));
 			return username;
 		case '@':
-			strncpy(username, identity, c - identity);
+			memcpy(username, identity, c - identity);
 			return username;
 		default:
 			continue;

Signature · 1 line

2.17.1

Denis Kenzior

Applied

2019-10-17 16:23 UTC #1 lore raw

Hi James,

Quoted 6 lines · James Prestwood

Two cases were using strcpy, and the other two were using strncpy. Instead all cases can use l_strlcpy which guarentees NULL termination.
---
  src/util.c | 8 ++++----
  1 file changed, 4 insertions(+), 4 deletions(-)

I split this up into two commits and reworked the commit descriptions a bit.

Applied, thanks.

Regards,
-Denis