Replace strcpy() with snprintf() when copying the helper socket path
into sun_path, preventing a potential buffer overflow from a long
argument and guaranteeing null-termination.
In target.c, move the argc check before accessing argv[4], so we
don't dereference past the end of argv.
Signed-off-by: Jon Maloy
---
v2: Use snprintf() instead of strncpy() for clarity and
guaranteed null-termination, as suggested by David Gibson
---
doc/migration/source.c | 2 +-
doc/migration/target.c | 8 +++-----
2 files changed, 4 insertions(+), 6 deletions(-)
diff --git a/doc/migration/source.c b/doc/migration/source.c
index d44ebf1f..8aad0259 100644
--- a/doc/migration/source.c
+++ b/doc/migration/source.c
@@ -47,7 +47,7 @@ int main(int argc, char **argv)
return -1;
}
- strcpy(a_helper.sun_path, argv[4]);
+ snprintf(a_helper.sun_path, sizeof(a_helper.sun_path), "%s", argv[4]);
getaddrinfo(argv[1], argv[2], &hints, &r);
/* Connect socket to server and send some data */
diff --git a/doc/migration/target.c b/doc/migration/target.c
index f7d31083..e2469837 100644
--- a/doc/migration/target.c
+++ b/doc/migration/target.c
@@ -38,11 +38,6 @@ int main(int argc, char **argv)
struct cmsghdr *cmsg = CMSG_FIRSTHDR(&msg);
struct addrinfo *r;
- (void)argc;
-
- strcpy(a_helper.sun_path, argv[4]);
- getaddrinfo(argv[1], argv[2], &hints, &r);
-
if (argc != 7) {
fprintf(stderr,
"%s DST_ADDR DST_PORT SRC_PORT HELPER_PATH SSEQ RSEQ\n",
@@ -50,6 +45,9 @@ int main(int argc, char **argv)
return -1;
}
+ snprintf(a_helper.sun_path, sizeof(a_helper.sun_path), "%s", argv[4]);
+ getaddrinfo(argv[1], argv[2], &hints, &r);
+
/* Prepare socket, bind to source port */
s = socket(r->ai_family, SOCK_STREAM, IPPROTO_TCP);
setsockopt(s, SOL_SOCKET, SO_REUSEADDR, &((int){ 1 }), sizeof(int));
--
2.52.0