Bug 504340 – app-misc/pax-utils-0.7 - scanelf.c:1572: Dangerous usage of 'sbuf' (strncpy doesn't always null-terminate it)

• Status: RESOLVED FIXED
• Product: Gentoo Linux

[Description David Binderman 2014-03-12 17:13:11 UTC]

Source code is

        char sbuf[126];
        strncpy(sbuf, match_etypes, sizeof(sbuf));
        if (strchr(match_etypes, ',') != NULL) {
            char *p;
            while ((p = strrchr(sbuf, ',')) != NULL) {

Suggest make sure sbuf is properly terminated.

        char sbuf[126];
        strncpy(sbuf, match_etypes, sizeof(sbuf));
        sbuf[125] = '\0';
        if (strchr(match_etypes, ',') != NULL) {
            char *p;
            while ((p = strrchr(sbuf, ',')) != NULL) {

[Comment 1 SpanKY 2014-03-20 08:06:02 UTC]

the match_etypes parsing logic is just bad ignoring the NUL terminator.  if you give it too many options, it silently ignores the excess.

instead, i updated it to use the array helpers:
http://sources.gentoo.org/gentoo-projects/pax-utils/scanelf.c?r1=1.261&r2=1.262