From owner-freebsd-bugs Fri Oct 26 8:20: 5 2001 Delivered-To: freebsd-bugs@hub.freebsd.org Received: from freefall.freebsd.org (freefall.FreeBSD.org [216.136.204.21]) by hub.freebsd.org (Postfix) with ESMTP id 702D637B405 for ; Fri, 26 Oct 2001 08:20:01 -0700 (PDT) Received: (from gnats@localhost) by freefall.freebsd.org (8.11.4/8.11.4) id f9QFK1e07958; Fri, 26 Oct 2001 08:20:01 -0700 (PDT) (envelope-from gnats) Date: Fri, 26 Oct 2001 08:20:01 -0700 (PDT) Message-Id: <200110261520.f9QFK1e07958@freefall.freebsd.org> To: freebsd-bugs@FreeBSD.org Cc: From: Garrett Wollman Subject: bin/31507: Risk of buffer overflow in struct sockaddr_un Reply-To: Garrett Wollman Sender: owner-freebsd-bugs@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org The following reply was made to PR bin/31507; it has been noted by GNATS. From: Garrett Wollman To: g@ural.org Cc: FreeBSD-gnats-submit@FreeBSD.ORG Subject: bin/31507: Risk of buffer overflow in struct sockaddr_un Date: Fri, 26 Oct 2001 11:18:04 -0400 (EDT) < There programmer may use folowing code: > struct sockaddr_un server; > #ifdef MAX_SUN_PATH > strncpy(server.sun_path, file_fifo, MAX_SUN_PATH); > #else > strncpy(server.sun_path, file_fifo, 104); /* or other platform-depended value */ > #endif No, the correct code would ALWAYS be: strncpy(server.sun_path, file_fifo, sizeof server.sun_path); POSIX says: # Applications should not assume a particular length for sun_path or # assume that it can hold {_POSIX_PATH_MAX} characters (255). -GAWollman To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-bugs" in the body of the message