From 866b995355894ab8f20d22a554d47322dcf1029a Mon Sep 17 00:00:00 2001 From: Andrea Claudi Date: Mon, 29 Apr 2019 20:09:13 +0200 Subject: [PATCH] utils: strlcpy() and strlcat() don't clobber dst Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1465646 Upstream Status: iproute2.git commit 50ea3c64384b1 commit 50ea3c64384b1d1bfa9c96de86c21ac8e9fef183 Author: Phil Sutter Date: Wed Sep 6 18:51:42 2017 +0200 utils: strlcpy() and strlcat() don't clobber dst As David Laight correctly pointed out, the first version of strlcpy() modified dst buffer behind the string copied into it. Fix this by writing NUL to the byte immediately following src string instead of to the last byte in dst. Doing so also allows to reduce overhead by using memcpy(). Improve strlcat() by avoiding the call to strlcpy() if dst string is already full, not just as sanity check. Signed-off-by: Phil Sutter --- lib/utils.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/lib/utils.c b/lib/utils.c index c9ba2f332c2a7..228d97bfe5e9b 100644 --- a/lib/utils.c +++ b/lib/utils.c @@ -1231,18 +1231,22 @@ int get_real_family(int rtm_type, int rtm_family) size_t strlcpy(char *dst, const char *src, size_t size) { + size_t srclen = strlen(src); + if (size) { - strncpy(dst, src, size - 1); - dst[size - 1] = '\0'; + size_t minlen = min(srclen, size - 1); + + memcpy(dst, src, minlen); + dst[minlen] = '\0'; } - return strlen(src); + return srclen; } size_t strlcat(char *dst, const char *src, size_t size) { size_t dlen = strlen(dst); - if (dlen > size) + if (dlen >= size) return dlen + strlen(src); return dlen + strlcpy(dst + dlen, src, size - dlen); -- 2.20.1