Fix possible string overrun/overcopy situation.

This commit is contained in:
Bill King
2010-06-11 13:38:38 +10:00
parent d074a0bfcc
commit 1a89786979
2 changed files with 6 additions and 3 deletions

View File

@@ -110,8 +110,9 @@ int main(int argc, char *argv[])
perror("Cannot create creator comm socket"); perror("Cannot create creator comm socket");
doExit(3); doExit(3);
} }
memset(&sau, 0, sizeof(sau));
sau.sun_family = AF_UNIX; sau.sun_family = AF_UNIX;
strcpy(sau.sun_path, argv[ArgSocket]); strncpy(sau.sun_path, argv[ArgSocket], sizeof(sau.sun_path) - 1);
if (connect(qtcFd, (struct sockaddr *)&sau, sizeof(sau))) { if (connect(qtcFd, (struct sockaddr *)&sau, sizeof(sau))) {
fprintf(stderr, "Cannot connect creator comm socket %s: %s\n", sau.sun_path, strerror(errno)); fprintf(stderr, "Cannot connect creator comm socket %s: %s\n", sau.sun_path, strerror(errno));
doExit(1); doExit(1);
@@ -136,7 +137,8 @@ int main(int argc, char *argv[])
fseek(envFd, 0, SEEK_END); fseek(envFd, 0, SEEK_END);
size = ftell(envFd); size = ftell(envFd);
rewind(envFd); rewind(envFd);
envdata = malloc(size); envdata = malloc(size + sizeof(char *));
envdata[size] = 0;
if (fread(envdata, 1, size, envFd) != (size_t)size) { if (fread(envdata, 1, size, envFd) != (size_t)size) {
perror("Failed to read env file"); perror("Failed to read env file");
doExit(1); doExit(1);

View File

@@ -148,7 +148,8 @@ int main()
fseek(envFd, 0, SEEK_END); fseek(envFd, 0, SEEK_END);
size = ftell(envFd); size = ftell(envFd);
rewind(envFd); rewind(envFd);
env = malloc(size); env = malloc(size + sizeof(wchar_t));
env[size] = 0;
if (fread(env, 1, size, envFd) != size) { if (fread(env, 1, size, envFd) != size) {
perror("Failed to read env file"); perror("Failed to read env file");
doExit(1); doExit(1);