From 54e345b5c2339dee170595f686dbd26937620262 Mon Sep 17 00:00:00 2001 From: Jim Meyering Date: Fri, 20 Apr 2012 21:27:25 +0200 Subject: avoid several strncpy-induced buffer overruns * restore.c (main): Ensure strncpy-copied dir_name is NUL-terminated. * btrfsctl.c (main): Likewise, for a command-line argument. * utils.c (multiple functions): Likewise. * btrfs-list.c (add_root): Likewise. * btrfslabel.c (change_label_unmounted): Likewise. * cmds-device.c (cmd_add_dev, cmd_rm_dev, cmd_scan_dev): Likewise. * cmds-filesystem.c (cmd_resize): Likewise. * cmds-subvolume.c (cmd_subvol_create, cmd_subvol_delete, cmd_snapshot): Likewise. Reviewed-by: Josef Bacik --- cmds-subvolume.c | 3 +++ 1 file changed, 3 insertions(+) (limited to 'cmds-subvolume.c') diff --git a/cmds-subvolume.c b/cmds-subvolume.c index 950fa8f0..fc749f12 100644 --- a/cmds-subvolume.c +++ b/cmds-subvolume.c @@ -111,6 +111,7 @@ static int cmd_subvol_create(int argc, char **argv) printf("Create subvolume '%s/%s'\n", dstdir, newname); strncpy(args.name, newname, BTRFS_PATH_NAME_MAX); + args.name[BTRFS_PATH_NAME_MAX-1] = 0; res = ioctl(fddst, BTRFS_IOC_SUBVOL_CREATE, &args); e = errno; @@ -202,6 +203,7 @@ static int cmd_subvol_delete(int argc, char **argv) printf("Delete subvolume '%s/%s'\n", dname, vname); strncpy(args.name, vname, BTRFS_PATH_NAME_MAX); + args.name[BTRFS_PATH_NAME_MAX-1] = 0; res = ioctl(fd, BTRFS_IOC_SNAP_DESTROY, &args); e = errno; @@ -378,6 +380,7 @@ static int cmd_snapshot(int argc, char **argv) args.fd = fd; strncpy(args.name, newname, BTRFS_SUBVOL_NAME_MAX); + args.name[BTRFS_PATH_NAME_MAX-1] = 0; res = ioctl(fddst, BTRFS_IOC_SNAP_CREATE_V2, &args); e = errno; -- cgit v1.2.3