VesperOS/shadow
6
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chfn: Replace STRFCPY() by STRLCPY()

Browse Source 
The variables are only being read as strings (char *), so data after the
'\0' can't be leaked.

Cc: Christian Göttsche <cgzones@googlemail.com>
Cc: Serge Hallyn <serge@hallyn.com>
Cc: Iker Pedrosa <ipedrosa@redhat.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
This commit is contained in:
Alejandro Colomar
2023-06-08 20:39:04 +02:00
committed by Iker Pedrosa
parent 5579b40e35
commit 8e33195c8e
1 changed files with 8 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
src/chfn.c
View File

@@ -32,6 +32,7 @@
/*@-exitarg@*/
#include "exitcodes.h"
#include "shadowlog.h"
#include "strlcpy.h"
/*
* Global variables.
@@ -275,7 +276,7 @@ static void process_flags (int argc, char **argv)
exit (E_NOPERM);
}
fflg = true;
STRFCPY (fullnm, optarg);
STRLCPY(fullnm, optarg);
break;
case 'h':
if (!may_change_field ('h')) {
@@ -284,7 +285,7 @@ static void process_flags (int argc, char **argv)
exit (E_NOPERM);
}
hflg = true;
STRFCPY (homeph, optarg);
STRLCPY(homeph, optarg);
break;
case 'o':
if (!amroot) {
@@ -298,7 +299,7 @@ static void process_flags (int argc, char **argv)
_("%s: fields too long\n"), Prog);
exit (E_NOPERM);
}
STRFCPY (slop, optarg);
STRLCPY(slop, optarg);
break;
case 'r':
if (!may_change_field ('r')) {
@@ -307,7 +308,7 @@ static void process_flags (int argc, char **argv)
exit (E_NOPERM);
}
rflg = true;
STRFCPY (roomno, optarg);
STRLCPY(roomno, optarg);
break;
case 'R': /* no-op, handled in process_root_flag () */
break;
@@ -321,7 +322,7 @@ static void process_flags (int argc, char **argv)
exit (E_NOPERM);
}
wflg = true;
STRFCPY (workph, optarg);
STRLCPY(workph, optarg);
break;
default:
usage (E_USAGE);
@@ -508,7 +509,8 @@ static void get_old_fields (const char *gecos)
{
char *cp; /* temporary character pointer */
char old_gecos[BUFSIZ]; /* buffer for old GECOS fields */
STRFCPY (old_gecos, gecos);
STRLCPY(old_gecos, gecos);
/*
* Now get the full name. It is the first comma separated field in