From fcb7974b838c2b37a8b81b88b11905c6ece398f6 Mon Sep 17 00:00:00 2001 From: Simon Wilkinson Date: Sat, 2 Mar 2013 10:27:47 +0000 Subject: [PATCH] util: Avoid overflow in GetNameByINet We copy the results of gethostbyaddr into a fixed length buffer without checking whether they fit. Add a length check, and use strlcpy to do the copy to make sure we can't overflow. Caught by coverity (#985912, #985872) Change-Id: I1e8f0fbb2577199c25201940f54646a4acdbbd37 Reviewed-on: http://gerrit.openafs.org/9393 Tested-by: BuildBot Reviewed-by: Jeffrey Altman --- src/util/hostparse.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/util/hostparse.c b/src/util/hostparse.c index 4644a97fd9..51c4bfb7ce 100644 --- a/src/util/hostparse.c +++ b/src/util/hostparse.c @@ -104,8 +104,8 @@ hostutil_GetNameByINet(afs_uint32 addr) return NULL; #endif th = gethostbyaddr((void *)&addr, sizeof(addr), AF_INET); - if (th) { - strcpy(tbuffer, th->h_name); + if (th && strlen(th->h_name) < sizeof(tbuffer)) { + strlcpy(tbuffer, th->h_name, sizeof(tbuffer)); } else { addr = ntohl(addr); sprintf(tbuffer, "%d.%d.%d.%d", (int)((addr >> 24) & 0xff),