Blame SOURCES/0084-Fix-the-length-of-several-strncpy-calls.patch

003ee8
From 531eb00aaa03f448cdb3f0c647db7f8d4544c50a Mon Sep 17 00:00:00 2001
003ee8
From: "Brian C. Lane" <bcl@redhat.com>
003ee8
Date: Mon, 23 Jul 2018 14:34:30 -0700
003ee8
Subject: [PATCH 84/88] Fix the length of several strncpy calls
003ee8
003ee8
These need to be 1 less than the allocated size of the buffer, strncpy
003ee8
will fill shorter strings with zeros, but there needs to be room for at
003ee8
least one 0x00 at the end if the string is the same length as the buffer
003ee8
and has no terminating 0x00.
003ee8
003ee8
Related: rhbz#1602652
003ee8
---
003ee8
 libparted/arch/linux.c | 12 ++++++++----
003ee8
 libparted/labels/mac.c |  9 ++++++---
003ee8
 2 files changed, 14 insertions(+), 7 deletions(-)
003ee8
003ee8
diff --git a/libparted/arch/linux.c b/libparted/arch/linux.c
003ee8
index 1c26b8c..dd4820d 100644
003ee8
--- a/libparted/arch/linux.c
003ee8
+++ b/libparted/arch/linux.c
003ee8
@@ -2571,9 +2571,12 @@ _blkpg_add_partition (PedDisk* disk, const PedPartition *part)
003ee8
                 linux_part.length = part->geom.length * disk->dev->sector_size;
003ee8
         }
003ee8
         linux_part.pno = part->num;
003ee8
-        strncpy (linux_part.devname, dev_name, BLKPG_DEVNAMELTH);
003ee8
-        if (vol_name)
003ee8
-                strncpy (linux_part.volname, vol_name, BLKPG_VOLNAMELTH);
003ee8
+        strncpy (linux_part.devname, dev_name, BLKPG_DEVNAMELTH-1);
003ee8
+        linux_part.devname[BLKPG_DEVNAMELTH-1] = '\0';
003ee8
+        if (vol_name) {
003ee8
+                strncpy (linux_part.volname, vol_name, BLKPG_VOLNAMELTH-1);
003ee8
+                linux_part.volname[BLKPG_VOLNAMELTH-1] = '\0';
003ee8
+        }
003ee8
 
003ee8
         free (dev_name);
003ee8
 
003ee8
@@ -2629,7 +2632,8 @@ static int _blkpg_resize_partition (PedDisk* disk, const PedPartition *part)
003ee8
         else
003ee8
                 linux_part.length = part->geom.length * disk->dev->sector_size;
003ee8
         linux_part.pno = part->num;
003ee8
-        strncpy (linux_part.devname, dev_name, BLKPG_DEVNAMELTH);
003ee8
+        strncpy (linux_part.devname, dev_name, BLKPG_DEVNAMELTH-1);
003ee8
+        linux_part.devname[BLKPG_DEVNAMELTH-1] = '\0';
003ee8
 
003ee8
         free (dev_name);
003ee8
 
003ee8
diff --git a/libparted/labels/mac.c b/libparted/labels/mac.c
003ee8
index fa4e43f..4942c82 100644
003ee8
--- a/libparted/labels/mac.c
003ee8
+++ b/libparted/labels/mac.c
003ee8
@@ -930,8 +930,10 @@ _generate_raw_part (PedDisk* disk, PedPartition* part,
003ee8
 		= PED_CPU_TO_BE32 (mac_disk_data->last_part_entry_num);
003ee8
 	part_map_entry->start_block = PED_CPU_TO_BE32 (part->geom.start);
003ee8
 	part_map_entry->block_count = PED_CPU_TO_BE32 (part->geom.length);
003ee8
-	strncpy (part_map_entry->name, mac_part_data->volume_name, 32);
003ee8
-	strncpy (part_map_entry->type, mac_part_data->system_name, 32);
003ee8
+	strncpy (part_map_entry->name, mac_part_data->volume_name, 31);
003ee8
+	part_map_entry->name[31] = '\0';
003ee8
+	strncpy (part_map_entry->type, mac_part_data->system_name, 31);
003ee8
+	part_map_entry->type[31] = '\0';
003ee8
 
003ee8
 	if (mac_part_data->is_driver) {
003ee8
 		if (mac_part_data->has_driver)
003ee8
@@ -954,7 +956,8 @@ _generate_raw_part (PedDisk* disk, PedPartition* part,
003ee8
 	part_map_entry->boot_cksum =
003ee8
 		PED_CPU_TO_BE32 (mac_part_data->boot_checksum);
003ee8
 
003ee8
-	strncpy (part_map_entry->processor, mac_part_data->processor_name, 16);
003ee8
+	strncpy (part_map_entry->processor, mac_part_data->processor_name, 15);
003ee8
+	part_map_entry->processor[15] = '\0';
003ee8
 
003ee8
 	if (!_pad_raw_part (disk, part->num, part_map))
003ee8
 		goto error;
003ee8
-- 
003ee8
2.17.1
003ee8