j3d1/tinc
1
0
Fork 0
Code Issues 1 Pull requests Releases Wiki Activity

Force nul-termination of strings after vsnprintf().

Browse source 
Apparently, on Windows this function might not always be properly
terminated.
This commit is contained in:
Guus Sliepen 2016-06-23 15:26:58 +02:00
parent 2de5d866b5
commit e16ab7b899
5 changed files with 12 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
src/bsd/tunemu.c
View file

@ -87,7 +87,7 @@ static void tun_error(char *format, ...)
{
va_list vl;
va_start(vl, format);
vsnprintf(tunemu_error, ERROR_BUFFER_SIZE, format, vl);
vsnprintf(tunemu_error, sizeof tunemu_error, format, vl);
va_end(vl);
}

1
src/dropin.c
View file

@ -106,6 +106,7 @@ int vasprintf(char **buf, const char *fmt, va_list ap) {
va_copy(aq, ap);
status = vsnprintf(*buf, len, fmt, aq);
buf[len - 1] = 0;
va_end(aq);
if(status >= 0)

8
src/logger.c
View file

@ -110,20 +110,22 @@ void logger(int level, int priority, const char *format, ...) {
va_start(ap, format);
int len = vsnprintf(message, sizeof message, format, ap);
message[sizeof message - 1] = 0;
va_end(ap);
if(len > 0 && len < sizeof message && message[len - 1] == '\n')
if(len > 0 && len < sizeof message - 1 && message[len - 1] == '\n')
message[len - 1] = 0;
real_logger(level, priority, message);
}
static void sptps_logger(sptps_t *s, int s_errno, const char *format, va_list ap) {
char message[1024] = "";
char message[1024];
size_t msglen = sizeof message;
int len = vsnprintf(message, msglen, format, ap);
if(len > 0 && len < sizeof message) {
message[sizeof message - 1] = 0;
if(len > 0 && len < sizeof message - 1) {
if(message[len - 1] == '\n')
message[--len] = 0;

5
src/protocol.c
View file

@ -72,10 +72,11 @@ bool send_request(connection_t *c, const char *format, ...) {
input buffer anyway */
va_start(args, format);
len = vsnprintf(request, MAXBUFSIZE, format, args);
len = vsnprintf(request, sizeof request, format, args);
request[sizeof request - 1] = 0;
va_end(args);
if(len < 0 || len > MAXBUFSIZE - 1) {
if(len < 0 || len > sizeof request - 1) {
logger(DEBUG_ALWAYS, LOG_ERR, "Output buffer overflow while sending request to %s (%s)",
c->name, c->hostname);
return false;

3
src/tincctl.c
View file

@ -560,6 +560,7 @@ bool sendline(int fd, char *format, ...) {
va_start(ap, format);
blen = vsnprintf(buffer, sizeof buffer, format, ap);
buffer[sizeof buffer - 1] = 0;
va_end(ap);
if(blen < 1 || blen >= sizeof buffer)
@ -885,7 +886,7 @@ static int cmd_start(int argc, char *argv[]) {
if(!pid) {
close(pfd[0]);
char buf[100] = "";
char buf[100];
snprintf(buf, sizeof buf, "%d", pfd[1]);
setenv("TINC_UMBILICAL", buf, true);
exit(execvp(c, nargv));