MonetDB: Dec2011 - table_constraint_name: avoid potential buffer...

[Fabian Groffen]

Changeset: f07428e6c155 for MonetDB
URL: http://dev.monetdb.org/hg/MonetDB?cmd=changeset;node=f07428e6c155
Modified Files:
        sql/server/rel_schema.c
Branch: Dec2011
Log Message:

table_constraint_name: avoid potential buffer overflow

strncpy does not add \0 if it doesn't fit.  strncat doesn't work
properly on Darwin9, so avoid using it to avoid a buffer overflow here
as well.  Bug #2914.


diffs (34 lines):

diff --git a/sql/server/rel_schema.c b/sql/server/rel_schema.c
--- a/sql/server/rel_schema.c
+++ b/sql/server/rel_schema.c
@@ -181,6 +181,7 @@ table_constraint_name(symbol *s, sql_tab
        char *suffix;           /* stores the type of this constraint */
        dnode *nms = NULL;
        static char buf[BUFSIZ];
+       size_t len;
 
        switch (s->token) {
                case SQL_UNIQUE:
@@ -201,16 +202,18 @@ table_constraint_name(symbol *s, sql_tab
        }
 
        /* copy table name */
-       strncpy(buf, t->base.name, BUFSIZ);
+       strncpy(buf, t->base.name, BUFSIZ - 1);
+       buf[BUFSIZ - 1] = '\0';
 
        /* add column name(s) */
        for (; nms; nms = nms->next) {
-               strncat(buf, "_", BUFSIZ - strlen(buf));
-               strncat(buf, nms->data.sval, BUFSIZ - strlen(buf));
+               len = strlen(buf);
+               snprintf(buf + len, BUFSIZ - len, "_%s", nms->data.sval);
        }
 
        /* add suffix */
-       strncat(buf, suffix, BUFSIZ - strlen(buf));
+       len = strlen(buf);
+       snprintf(buf + len, BUFSIZ - len, "%s", suffix);
 
        return buf;
 }
_______________________________________________
Checkin-list mailing list
Checkin-list@monetdb.org
http://mail.monetdb.org/mailman/listinfo/checkin-list