diff options
| author | Jim Meyering <meyering@redhat.com> | 2012-10-04 13:09:46 +0200 |
|---|---|---|
| committer | Anthony Liguori <aliguori@us.ibm.com> | 2012-10-05 07:58:36 -0500 |
| commit | c2cba3d9314f972dfaf724d0ec2d018eb54c95f1 (patch) | |
| tree | 2a3572afbfaa3bbac89eb0a5166b4384bb60bf81 /block.c | |
| parent | bfad67399bcca8c1afbbc93593d365044d92f7c6 (diff) | |
block: avoid buffer overrun by using pstrcpy, not strncpy
Also, use PATH_MAX, rather than the arbitrary 1024.
Using PATH_MAX is more consistent with other filename-related
variables in this file, like backing_filename and tmp_filename.
Acked-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Jim Meyering <meyering@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Diffstat (limited to 'block.c')
| -rw-r--r-- | block.c | 5 |
1 files changed, 3 insertions, 2 deletions
@@ -1506,7 +1506,7 @@ int bdrv_commit(BlockDriverState *bs) int n, ro, open_flags; int ret = 0; uint8_t *buf; - char filename[1024]; + char filename[PATH_MAX]; if (!drv) return -ENOMEDIUM; @@ -1520,7 +1520,8 @@ int bdrv_commit(BlockDriverState *bs) } ro = bs->backing_hd->read_only; - strncpy(filename, bs->backing_hd->filename, sizeof(filename)); + /* Use pstrcpy (not strncpy): filename must be NUL-terminated. */ + pstrcpy(filename, sizeof(filename), bs->backing_hd->filename); open_flags = bs->backing_hd->open_flags; if (ro) { |