fix svace defect,there may be buffer overflow attacks

Change-Id: If410c65b0cae49276643cd20899fe3887709b959

diff --git a/src/mediadb-update.c b/src/mediadb-update.c
index edef8e4..4163ea6 100755 (executable)
--- a/src/mediadb-update.c
+++ b/src/mediadb-update.c
@@ -491,12 +491,12 @@ int main(int argc, char **argv)
 
                if (g_file_test(argv1, G_FILE_TEST_IS_DIR)) {
                        len = strlen(argv1);
-
-                       if (argv1[len - 1] == '/')
-                               strncpy(req_path, argv1, len - 1);
-                       else
-                               strncpy(req_path, argv1, len);
-
+                       if (len < sizeof(req_path)) {
+                               if (argv1[len - 1] == '/')
+                                       strncpy(req_path, argv1, len - 1);
+                               else
+                                       strncpy(req_path, argv1, len);
+                       }
                        ret = dir_scan_non_recursive(req_path);
                        if (ret != 0) {
                                printf("error : %d\n", ret);
@@ -512,11 +512,12 @@ int main(int argc, char **argv)
                if (strcmp(argv1, "-r") == 0) {
                        if ((argv2 != NULL) && (g_file_test(argv2, G_FILE_TEST_IS_DIR))) {
                                len = strlen(argv2);
-
-                               if (argv2[len - 1] == '/')
-                                       strncpy(req_path, argv2, len - 1);
-                               else
-                                       strncpy(req_path, argv2, len);
+                               if (len < sizeof(req_path)) {
+                                       if (argv2[len - 1] == '/')
+                                               strncpy(req_path, argv2, len - 1);
+                                       else
+                                               strncpy(req_path, argv2, len);
+                               }
 
                                ret = dir_scan_recursive(req_path);
                                if (ret != 0) {