Use strcmp() rather than strncmp()
authorWouter Verhelst <w@uter.be>
Tue, 26 Nov 2013 13:32:31 +0000 (14:32 +0100)
committerWouter Verhelst <w@uter.be>
Tue, 26 Nov 2013 13:32:31 +0000 (14:32 +0100)
This results in some false positives. If the authfile contains:

192.168.0.12

and the client is

192.168.0.1

then access will be granted, because the strcmp was limiting to
"192.168.0.1" for no particularly good reason.

We should also canonicalize our names and work on that, rather than
doing a simple strcmp(), but that's for later.

nbd-server.c

index 1cd25bc..080659d 100644 (file)
@@ -364,7 +364,7 @@ int authorized_client(CLIENT *opts) {
                                return 1;
                        }
                }
-               if (strncmp(line,opts->clientname,strlen(opts->clientname))==0) {
+               if (strcmp(line,opts->clientname)==0) {
                        fclose(f);
                        return 1;
                }