From owner-freebsd-hackers  Mon Jan 13 02:21:39 1997
Return-Path: <owner-hackers>
Received: (from root@localhost)
          by freefall.freebsd.org (8.8.4/8.8.4) id CAA04146
          for hackers-outgoing; Mon, 13 Jan 1997 02:21:39 -0800 (PST)
Received: from godzilla.zeta.org.au (godzilla.zeta.org.au [203.2.228.19])
          by freefall.freebsd.org (8.8.4/8.8.4) with ESMTP id CAA04135
          for <hackers@FreeBSD.org>; Mon, 13 Jan 1997 02:21:32 -0800 (PST)
Received: (from bde@localhost) by godzilla.zeta.org.au (8.8.3/8.6.9) id VAA14907; Mon, 13 Jan 1997 21:17:04 +1100
Date: Mon, 13 Jan 1997 21:17:04 +1100
From: Bruce Evans <bde@zeta.org.au>
Message-Id: <199701131017.VAA14907@godzilla.zeta.org.au>
To: davidn@unique.usn.blaze.net.au, joerg_wunsch@uriah.heep.sax.de
Subject: Re: unused variable in su
Cc: hackers@FreeBSD.org
Sender: owner-hackers@FreeBSD.org
X-Loop: FreeBSD.org
Precedence: bulk

>> Still, it's fairly obfuscated code.  It could be better worded:
>
>IMHO, it is fine (and yes, it should be strncpy()). Using the return

It should be strdup().  Using strncpy() or snprintf() to handle buffer
overflows by truncating the string is sloppy.

>> Btw., shouldn't it better be a strncpy() anyway?  Sure, /etc/shells is
>> at the mercy of the sysadmin, but he isn't unfailable.
>
>It is /etc/master.passwd in this case, but what you say is still true.
>In a setuid binary no less, but fortunately no "return" anywhere in
>main().

It may be possible to clear the variable `ruid' by overwriting the first
byte of it with the terminating null...

Bruce