ecore_con_local: Add NULL termination 27/82727/3
authorPrateek Thakur <prateek.th@samsung.com>
Fri, 5 Aug 2016 09:08:13 +0000 (14:38 +0530)
committerGerrit Code Review <gerrit@review.vlan103.tizen.org>
Sun, 21 Aug 2016 23:31:12 +0000 (16:31 -0700)
Copying from string 'buf' of length 4095 to '&socket_unix.sun_path[0]'
may form a non-terminated C string of size 108. So added null termination.

Change-Id: Icdd2cd4eaf213852196cf551ee7d3ef5a252f8ee
Signed-off-by: Prateek Thakur <prateek.th@samsung.com>
src/lib/ecore_con/ecore_con_local.c [changed mode: 0644->0755]

old mode 100644 (file)
new mode 100755 (executable)
index dc81334..cadd551
@@ -259,7 +259,8 @@ ecore_con_local_connect(Ecore_Con_Server *obj,
      }
    else
      {
-        strncpy(socket_unix.sun_path, buf, sizeof(socket_unix.sun_path));
+        strncpy(socket_unix.sun_path, buf, sizeof(socket_unix.sun_path) - 1);
+        socket_unix.sun_path[sizeof(socket_unix.sun_path) - 1] = '\0';
         socket_unix_len = LENGTH_OF_SOCKADDR_UN(&socket_unix);
      }
 
@@ -419,7 +420,8 @@ start:
    else
      {
         abstract_socket = EINA_FALSE;
-        strncpy(socket_unix.sun_path, buf, sizeof(socket_unix.sun_path));
+        strncpy(socket_unix.sun_path, buf, sizeof(socket_unix.sun_path) - 1);
+        socket_unix.sun_path[sizeof(socket_unix.sun_path) - 1] = '\0';
         socket_unix_len = LENGTH_OF_SOCKADDR_UN(&socket_unix);
      }