prevent buffer overflow at strncat

- The third argument of strncat is the string length to be copied, not buffer size.
  So the last byte should be left for NULL character which terminates string.
- The alias arguemnt is under control of a client,
  this alias variable can be manipulated maliciouly by the client.

Change-Id: Iff4677af36b91d02b7127eb46360033a301b5f87
Signed-off-by: Dongsun Lee <ds73.lee@samsung.com>

diff --git a/src/manager/client-capi/ckmc-type.cpp b/src/manager/client-capi/ckmc-type.cpp
index 8ac6a2b..1820aa9 100644 (file)
--- a/src/manager/client-capi/ckmc-type.cpp
+++ b/src/manager/client-capi/ckmc-type.cpp
@@ -84,8 +84,8 @@ int ckmc_alias_new(const char *owner_id, const char *alias, char **full_alias)
                return CKMC_ERROR_OUT_OF_MEMORY;
 
        strncpy(_full_alias, owner_id, len + 1);
-       strncat(_full_alias, ckmc_owner_id_separator, len - strlen(_full_alias) + 1);
-       strncat(_full_alias, alias, len - strlen(_full_alias) + 1);
+       strncat(_full_alias, ckmc_owner_id_separator, len - strlen(_full_alias));
+       strncat(_full_alias, alias, len - strlen(_full_alias));
 
        *full_alias = _full_alias;