autofs-5.1.0 - fix buffer size checks in get_network_proximity() From: Ian Kent Add several buffer size checks in get_network_proximity(). --- CHANGELOG | 1 + lib/parse_subs.c | 8 +++++--- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/CHANGELOG b/CHANGELOG index 6977443..86166d7 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -10,6 +10,7 @@ - fix FILE pointer check in defaults_read_config(). - fix memory leak in conf_amd_get_log_options(). - fix signed comparison in inet_fill_net(). +- fix buffer size checks in get_network_proximity(). 04/06/2014 autofs-5.1.0 ======================= diff --git a/lib/parse_subs.c b/lib/parse_subs.c index c1648c2..9af5106 100644 --- a/lib/parse_subs.c +++ b/lib/parse_subs.c @@ -437,7 +437,7 @@ unsigned int get_network_proximity(const char *name) { struct addrinfo hints; struct addrinfo *ni, *this; - char name_or_num[NI_MAXHOST]; + char name_or_num[NI_MAXHOST + 1]; unsigned int proximity; char *net; int ret; @@ -449,16 +449,18 @@ unsigned int get_network_proximity(const char *name) if (net) strcpy(name_or_num, net); else { - char this[NI_MAXHOST]; + char this[NI_MAXHOST + 1]; char *mask; + if (strlen(name) > NI_MAXHOST) + return PROXIMITY_ERROR; strcpy(this, name); if ((mask = strchr(this, '/'))) *mask++ = '\0'; if (!strchr(this, '.')) strcpy(name_or_num, this); else { - char buf[NI_MAXHOST], *new; + char buf[NI_MAXHOST + 1], *new; new = inet_fill_net(this, buf); if (!new) return PROXIMITY_ERROR;