gcc warns about a potential buffer overflow:
In file included from /usr/include/string.h:642:0,
from pkcs15-itacns.c:38:
In function 'strncat',
inlined from 'itacns_add_keyset.clone.3' at pkcs15-itacns.c:540:9:
/usr/include/bits/string3.h:154:3: warning: call to
__builtin___strncat_chk might overflow destination buffer
In function 'strncat',
inlined from 'itacns_add_keyset.clone.3' at pkcs15-itacns.c:552:9:
/usr/include/bits/string3.h:154:3: warning: call to
__builtin___strncat_chk might overflow destination buffer
And fair enough, strncat(3) also says:
"If src contains n or more characters, strncat() writes n+1
characters to dest (n from src plus the terminating null byte).
Therefore, the size of dest must be at least strlen(dest)+n+1."
The attached patch builds, but otherwise is untested.
--
Kalev
Index: src/libopensc/pkcs15-itacns.c
===================================================================
--- src/libopensc/pkcs15-itacns.c (revision 4631)
+++ src/libopensc/pkcs15-itacns.c (working copy)
@@ -549,7 +549,7 @@
"Could not add PIN");
strncpy(pinlabel, "PUK ", sizeof(pinlabel));
- strncat(pinlabel, label, sizeof(pinlabel));
+ strncat(pinlabel, label, sizeof(pinlabel)-strlen(pinlabel)-1);
/*
* Looking at pkcs15-tcos.c and pkcs15-framework.c, it seems that the
* right thing to do here is to define a PUK as a SO PIN. Can anybody
_______________________________________________
opensc-devel mailing list
[email protected]
http://www.opensc-project.org/mailman/listinfo/opensc-devel
