Re: [PATCH v2 4/6] doc/migration: Use snprintf() for socket path and fix argv access

10 Jul 2026

On Thu, Jul 09, 2026 at 05:56:54PM -0400, Jon Maloy wrote:
...
Replace strcpy() with snprintf() when copying the helper socket path
into sun_path, preventing a potential buffer overflow from a long
argument and guaranteeing null-termination.
In target.c, move the argc check before accessing argv[4], so we
don't dereference past the end of argv.
Signed-off-by: Jon Maloy 
Reviewed-by: David Gibson 

Although... it wouldn't surprise me if some static checker now
complains about not testing the return value from snprintf().
...
---
v2: Use snprintf() instead of strncpy() for clarity and
    guaranteed null-termination, as suggested by David Gibson
---
 doc/migration/source.c | 2 +-
 doc/migration/target.c | 8 +++-----
 2 files changed, 4 insertions(+), 6 deletions(-)

diff --git a/doc/migration/source.c b/doc/migration/source.c
index d44ebf1f..8aad0259 100644
--- a/doc/migration/source.c
+++ b/doc/migration/source.c
@@ -47,7 +47,7 @@ int main(int argc, char **argv)
      return -1;
  }
-	strcpy(a_helper.sun_path, argv[4]);
+	snprintf(a_helper.sun_path, sizeof(a_helper.sun_path), "%s", argv[4]);
  getaddrinfo(argv[1], argv[2], &hints, &r);
/* Connect socket to server and send some data */
diff --git a/doc/migration/target.c b/doc/migration/target.c
index f7d31083..e2469837 100644
--- a/doc/migration/target.c
+++ b/doc/migration/target.c
@@ -38,11 +38,6 @@ int main(int argc, char **argv)
  struct cmsghdr *cmsg = CMSG_FIRSTHDR(&msg);
  struct addrinfo *r;
-	(void)argc;
-
-	strcpy(a_helper.sun_path, argv[4]);
-	getaddrinfo(argv[1], argv[2], &hints, &r);
-
  if (argc != 7) {
      fprintf(stderr,
      	"%s DST_ADDR DST_PORT SRC_PORT HELPER_PATH SSEQ RSEQ\n",
@@ -50,6 +45,9 @@ int main(int argc, char **argv)
      return -1;
  }
+	snprintf(a_helper.sun_path, sizeof(a_helper.sun_path), "%s", argv[4]);
+	getaddrinfo(argv[1], argv[2], &hints, &r);
+
  /* Prepare socket, bind to source port */
  s = socket(r->ai_family, SOCK_STREAM, IPPROTO_TCP);
  setsockopt(s, SOL_SOCKET, SO_REUSEADDR, &((int){ 1 }), sizeof(int));
-- 
2.52.0
-- 
David Gibson (he or they)	| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au	| minimalist, thank you, not the other way
				| around.
http://www.ozlabs.org/~dgibson

    