diff options
| author | François Perrad <francois.perrad@gadz.org> | 2019-03-20 15:09:19 +0100 |
|---|---|---|
| committer | Matt Johnston <matt@ucc.asn.au> | 2019-03-20 22:09:19 +0800 |
| commit | 28b6111db0f4ced931f2ce4b890a8d109904b8e2 (patch) | |
| tree | 3ff28d553d9a52c18d302a13aef6bc46a6f1025c /svr-authpubkey.c | |
| parent | a0aa2749813331134452f80bb8a808bdc871ba41 (diff) | |
use strlcpy & strlcat (#74)
* refactor checkpubkeyperms() with safe BSD functions
fix gcc8 warnings
```
svr-authpubkey.c: In function 'checkpubkeyperms':
svr-authpubkey.c:427:2: warning: 'strncat' specified bound 5 equals source length [-Wstringop-overflow=]
strncat(filename, "/.ssh", 5); /* strlen("/.ssh") == 5 */
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
svr-authpubkey.c:433:2: warning: 'strncat' specified bound 16 equals source length [-Wstringop-overflow=]
strncat(filename, "/authorized_keys", 16);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
```
see https://www.sudo.ws/todd/papers/strlcpy.html
* restore strlcpy in xstrdup
see original https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/xmalloc.c?rev=1.16
Diffstat (limited to 'svr-authpubkey.c')
| -rw-r--r-- | svr-authpubkey.c | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/svr-authpubkey.c b/svr-authpubkey.c index ae1402d..dafa99a 100644 --- a/svr-authpubkey.c +++ b/svr-authpubkey.c @@ -424,8 +424,9 @@ static int checkpubkeyperms() { /* allocate max required pathname storage, * = path + "/.ssh/authorized_keys" + '\0' = pathlen + 22 */ - filename = m_malloc(len + 22); - strncpy(filename, ses.authstate.pw_dir, len+1); + len += 22; + filename = m_malloc(len); + strlcpy(filename, ses.authstate.pw_dir, len); /* check ~ */ if (checkfileperm(filename) != DROPBEAR_SUCCESS) { @@ -433,13 +434,13 @@ static int checkpubkeyperms() { } /* check ~/.ssh */ - strncat(filename, "/.ssh", 5); /* strlen("/.ssh") == 5 */ + strlcat(filename, "/.ssh", len); if (checkfileperm(filename) != DROPBEAR_SUCCESS) { goto out; } /* now check ~/.ssh/authorized_keys */ - strncat(filename, "/authorized_keys", 16); + strlcat(filename, "/authorized_keys", len); if (checkfileperm(filename) != DROPBEAR_SUCCESS) { goto out; } |