[Cluster-devel] [PATCH 06/41] libcman: switch to strncpy to avoid possible buffer overflows

[Fabio M. Di Nitto]

Spotted by Coverity Scan

Signed-off-by: Fabio M. Di Nitto <fdini...@redhat.com>
---
:100644 100644 ae6c709... b49cf6f... M  cman/lib/libcman.c
 cman/lib/libcman.c |   30 +++++++++++++++---------------
 1 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/cman/lib/libcman.c b/cman/lib/libcman.c
index ae6c709..b49cf6f 100644
--- a/cman/lib/libcman.c
+++ b/cman/lib/libcman.c
@@ -82,7 +82,7 @@ static void copy_node(cman_node_t *unode, struct 
cl_cluster_node *knode)
 {
        unode->cn_nodeid = knode->node_id;
        unode->cn_member = knode->state == NODESTATE_MEMBER?1:0;
-       strcpy(unode->cn_name, knode->name);
+       strncpy(unode->cn_name, knode->name, sizeof(unode->cn_name) - 1);
        unode->cn_incarnation = knode->incarnation;
        unode->cn_jointime = knode->jointime;
 
@@ -678,14 +678,14 @@ int cman_get_node(cman_handle_t handle, int nodeid, 
cman_node_t *node)
        int status;
        VALIDATE_HANDLE(h);
 
-       if (!node || strlen(node->cn_name) > sizeof(cman_node.name))
+       if (!node || strlen(node->cn_name) >= sizeof(cman_node.name))
        {
                errno = EINVAL;
                return -1;
        }
 
        cman_node.node_id = nodeid;
-       strcpy(cman_node.name, node->cn_name);
+       strncpy(cman_node.name, node->cn_name, sizeof(cman_node.name) - 1);
        status = info_call(h, CMAN_CMD_GETNODE, &cman_node, sizeof(struct 
cl_cluster_node),
                           &cman_node, sizeof(struct cl_cluster_node));
        if (status < 0)
@@ -905,14 +905,14 @@ int cman_barrier_register(cman_handle_t handle, const 
char *name, int flags, int
        struct cl_barrier_info binfo;
        VALIDATE_HANDLE(h);
 
-       if (strlen(name) > MAX_BARRIER_NAME_LEN)
+       if (strlen(name) >= MAX_BARRIER_NAME_LEN)
        {
                errno = EINVAL;
                return -1;
        }
 
        binfo.cmd = BARRIER_CMD_REGISTER;
-       strcpy(binfo.name, name);
+       strncpy(binfo.name, name, sizeof(binfo.name) - 1);
        binfo.arg = nodes;
        binfo.flags = flags;
 
@@ -926,14 +926,14 @@ int cman_barrier_change(cman_handle_t handle, const char 
*name, int flags, int a
        struct cl_barrier_info binfo;
        VALIDATE_HANDLE(h);
 
-       if (strlen(name) > MAX_BARRIER_NAME_LEN)
+       if (strlen(name) >= MAX_BARRIER_NAME_LEN)
        {
                errno = EINVAL;
                return -1;
        }
 
        binfo.cmd = BARRIER_CMD_CHANGE;
-       strcpy(binfo.name, name);
+       strncpy(binfo.name, name, sizeof(binfo.name) - 1);
        binfo.arg = arg;
        binfo.flags = flags;
 
@@ -947,14 +947,14 @@ int cman_barrier_wait(cman_handle_t handle, const char 
*name)
        struct cl_barrier_info binfo;
        VALIDATE_HANDLE(h);
 
-       if (strlen(name) > MAX_BARRIER_NAME_LEN)
+       if (strlen(name) >= MAX_BARRIER_NAME_LEN)
        {
                errno = EINVAL;
                return -1;
        }
 
        binfo.cmd = BARRIER_CMD_WAIT;
-       strcpy(binfo.name, name);
+       strncpy(binfo.name, name, sizeof(binfo.name) - 1);
 
        return info_call(h, CMAN_CMD_BARRIER, &binfo, sizeof(binfo), NULL, 0);
 }
@@ -965,14 +965,14 @@ int cman_barrier_delete(cman_handle_t handle, const char 
*name)
        struct cl_barrier_info binfo;
        VALIDATE_HANDLE(h);
 
-       if (strlen(name) > MAX_BARRIER_NAME_LEN)
+       if (strlen(name) >= MAX_BARRIER_NAME_LEN)
        {
                errno = EINVAL;
                return -1;
        }
 
        binfo.cmd = BARRIER_CMD_DELETE;
-       strcpy(binfo.name, name);
+       strncpy(binfo.name, name, sizeof(binfo.name) - 1);
 
        return info_call(h, CMAN_CMD_BARRIER, &binfo, sizeof(binfo), NULL, 0);
 }
@@ -1019,7 +1019,7 @@ static int cman_set_quorum_device(cman_handle_t handle,
        VALIDATE_HANDLE(h);
 
        memcpy(buf, &votes, sizeof(int));
-       strcpy(buf+sizeof(int), name);
+       strncpy(buf+sizeof(int), name, strlen(name)+1 + sizeof(int) - 1);
        return info_call(h, ops, buf, strlen(name)+1+sizeof(int), NULL, 0);
 }
 
@@ -1059,7 +1059,7 @@ int cman_get_quorum_device(cman_handle_t handle, struct 
cman_qdev_info *info)
        cman_node.node_id = CLUSTER_GETNODE_QUORUMDEV;
        ret = info_call(h, CMAN_CMD_GETNODE, &cman_node, sizeof(cman_node), 
&cman_node, sizeof(cman_node));
        if (!ret) {
-               strcpy(info->qi_name, cman_node.name);
+               strncpy(info->qi_name, cman_node.name, sizeof(info->qi_name) - 
1);
                info->qi_state = cman_node.state;
                info->qi_votes = cman_node.votes;
        }
@@ -1087,7 +1087,7 @@ int cman_get_fenceinfo(cman_handle_t handle, int nodeid, 
uint64_t *time, int *fe
        if (!ret) {
                *time = f.fence_time;
                if (agent)
-                       strcpy(agent, f.fence_agent);
+                       strncpy(agent, f.fence_agent, sizeof(f.fence_agent) - 
1);
                *fenced = ((f.flags & FENCE_FLAGS_FENCED) != 0);
        }
        return ret;
@@ -1131,6 +1131,6 @@ int cman_node_fenced(cman_handle_t handle, int nodeid, 
uint64_t time, char *agen
 
        f.nodeid = nodeid;
        f.fence_time = time;
-       strcpy(f.fence_agent, agent);
+       strncpy(f.fence_agent, agent, sizeof(f.fence_agent) - 1);
        return info_call(h, CMAN_CMD_UPDATE_FENCE_INFO, &f, sizeof(f), NULL, 0);
 }
-- 
1.7.4.4