diff options
| author | Eric Sandeen <sandeen@redhat.com> | 2013-01-25 13:27:48 -0600 |
|---|---|---|
| committer | Zach Brown <zab@redhat.com> | 2013-02-05 16:09:41 -0800 |
| commit | 899ba61fa695ae8e58599da25d174afa392fd552 (patch) | |
| tree | 01f68bbf84ebd8a4c12cf80a23fdabca4fb9b54c /cmds-receive.c | |
| parent | bcb2b73358f1c05e6b5c48cfd19e3762cc69c677 (diff) | |
btrfs-progs: fix overflows of ioctl name args
3 places where we copy pathnames into ioctl arguments
were not limited to the destination name size, and
could overflow. Use the new strncpy_null() macro
to make this safe.
Signed-off-by: Eric Sandeen <sandeen@redhat.com>
Diffstat (limited to 'cmds-receive.c')
| -rw-r--r-- | cmds-receive.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/cmds-receive.c b/cmds-receive.c index e6291744..6688d0c8 100644 --- a/cmds-receive.c +++ b/cmds-receive.c @@ -43,6 +43,7 @@ #include "ctree.h" #include "ioctl.h" #include "commands.h" +#include "utils.h" #include "list.h" #include "send.h" @@ -165,7 +166,7 @@ static int process_subvol(const char *path, const u8 *uuid, u64 ctransid, } memset(&args_v1, 0, sizeof(args_v1)); - strcpy(args_v1.name, path); + strncpy_null(args_v1.name, path); ret = ioctl(r->mnt_fd, BTRFS_IOC_SUBVOL_CREATE, &args_v1); if (ret < 0) { ret = -errno; @@ -213,7 +214,7 @@ static int process_snapshot(const char *path, const u8 *uuid, u64 ctransid, } memset(&args_v2, 0, sizeof(args_v2)); - strcpy(args_v2.name, path); + strncpy_null(args_v2.name, path); r->parent_subvol = subvol_uuid_search(&r->sus, 0, parent_uuid, parent_ctransid, NULL, subvol_search_by_received_uuid); |