From 47c5c31a6ceb6abe8b406eb74d87aa429c3b93ea Mon Sep 17 00:00:00 2001
From: "Andrew G. Morgan" <morgan@kernel.org>
Date: Fri, 12 Oct 2001 06:13:10 +0000
Subject: Relevant BUGIDs: 435991

Purpose of commit: bugfix

Commit summary:
---------------
use strncpy, and even then remember to nul terminate. Courtesy of Harald Welte.
---
 CHANGELOG                             |  3 ++-
 modules/pam_env/pam_env.c             |  3 ++-
 modules/pam_mkhomedir/pam_mkhomedir.c | 16 +++++++---------
 3 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index e45fc027..ee097cdf 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -50,7 +50,8 @@ bug report - outstanding bugs are listed here:
       patches!
 
 * more changes (extracted from redhat version) courtesy of
-  Harald Welte (Bugs pam_limits=436061, pam_lastlog=436060 - agmorgan)
+  Harald Welte (Bugs pam_limits=436061, pam_lastlog=436060,
+  pam_mkhomedir/pam_env=435991 - agmorgan)
 * fix for legacy behavior of pam_setcred and pam_close_session in
   the case that pam_authenticate and pam_open_session hadn't been
   called - bug report from Seongwan Park. (Bug 468724 - agmorgan)
diff --git a/modules/pam_env/pam_env.c b/modules/pam_env/pam_env.c
index f140f3cb..52e54490 100644
--- a/modules/pam_env/pam_env.c
+++ b/modules/pam_env/pam_env.c
@@ -588,7 +588,8 @@ static int _expand_arg(pam_handle_t *pamh, char **value)
 	  _log_err(LOG_ERR, "Unterminated expandable variable: <%s>", orig-2);
 	  return PAM_ABORT;
 	}
-	strncpy(tmpval, orig, (size_t) BUF_SIZE);
+	strncpy(tmpval, orig, sizeof(tmpval));
+	tmpval[sizeof(tmpval)-1] = '\0';
 	orig=ptr;
 	/* 
 	 * so, we know we need to expand tmpval, it is either 
diff --git a/modules/pam_mkhomedir/pam_mkhomedir.c b/modules/pam_mkhomedir/pam_mkhomedir.c
index ec05993d..ec6bd46d 100644
--- a/modules/pam_mkhomedir/pam_mkhomedir.c
+++ b/modules/pam_mkhomedir/pam_mkhomedir.c
@@ -57,7 +57,7 @@
 #define MKHOMEDIR_QUIET      040	/* keep quiet about things */
 
 static unsigned int UMask = 0022;
-static char SkelDir[BUFSIZ] = "/etc/skel";
+static char SkelDir[BUFSIZ] = "/etc/skel"; /* THIS MODULE IS NOT THREAD SAFE */
 
 /* some syslogging */
 static void _log_err(int err, const char *format, ...)
@@ -82,16 +82,14 @@ static int _pam_parse(int flags, int argc, const char **argv)
    /* step through arguments */
    for (; argc-- > 0; ++argv)
    {
-      if (!strcmp(*argv, "silent"))
-      {
+      if (!strcmp(*argv, "silent")) {
 	 ctrl |= MKHOMEDIR_QUIET;
-      } 
-      else if (!strncmp(*argv,"umask=",6))
+      } else if (!strncmp(*argv,"umask=",6)) {
 	 UMask = strtol(*argv+6,0,0);
-      else if (!strncmp(*argv,"skel=",5))
-	 strcpy(SkelDir,*argv+5);
-      else
-      {
+      } else if (!strncmp(*argv,"skel=",5)) {
+	 strncpy(SkelDir,*argv+5,sizeof(SkelDir));
+	 SkelDir[sizeof(SkelDir)-1] = '\0';
+      } else {
 	 _log_err(LOG_ERR, "unknown option; %s", *argv);
       }
    }
-- 
cgit v1.2.3