Prevent buffer overflow on reading value

Change-Id: I4a6d5abce72c4f2165a0d190068ef75157cf4c35
Signed-off-by: Kichan Kwon <k_c.kwon@samsung.com>

diff --git a/src/system_info.c b/src/system_info.c
index 821fe93b3e7db734852a1bd093c595b196b7c267..5c2d24dc9d19c637ee14a0e8dd0ba144610a649a 100644 (file)
--- a/src/system_info.c
+++ b/src/system_info.c
@@ -74,6 +74,7 @@ static int db_get_value(enum tag_type tag, const char *key,
        char key_internal[KEY_MAX];
        size_t key_internal_len;
        char buf[PATH_MAX];     // buffer size should be larger than KEY_MAX
+       size_t value_internal_len;
        FILE *fp = NULL;
        int ret;
        char *tag_s;
@@ -124,7 +125,9 @@ static int db_get_value(enum tag_type tag, const char *key,
        key_internal_len = strlen(key_internal);
        while ((temp = fgets(buf, sizeof(buf), fp))) {
                if (!strncmp(buf, key_internal, key_internal_len) && buf[key_internal_len] == ' ') {
-                       sscanf(buf, "%*s %[^\n]s", value);
+                       value_internal_len = strcspn(buf + key_internal_len + 1, "\n") + 1;
+                       snprintf(value, len < value_internal_len ? len : value_internal_len,
+                                       "%s", buf + key_internal_len + 1);
                        break;
                }
        }