From 2924bca7d31d8e1b2ca239316b603082e0a4cb33 Mon Sep 17 00:00:00 2001
From: Marcel Holtmann <marcel@holtmann.org>
Date: Wed, 15 Feb 2006 08:21:57 +0000
Subject: Fix problems with the size limitation of netdev string

---
 pand/bnep.c |  5 +++--
 pand/main.c | 12 +++++++++---
 2 files changed, 12 insertions(+), 5 deletions(-)

(limited to 'pand')

diff --git a/pand/bnep.c b/pand/bnep.c
index 3e7283f3..0f935d39 100644
--- a/pand/bnep.c
+++ b/pand/bnep.c
@@ -184,12 +184,13 @@ static int bnep_connadd(int sk, uint16_t role, char *dev)
 {
 	struct bnep_connadd_req req;
 
-	strcpy(req.device, dev);
+	strncpy(req.device, dev, 16);
+	req.device[15] = '\0';
 	req.sock = sk;
 	req.role = role;
 	if (ioctl(ctl, bnepconnadd, &req))
 		return -1;
-	strcpy(dev, req.device);
+	strncpy(dev, req.device, 16);
 	return 0;
 }
 
diff --git a/pand/main.c b/pand/main.c
index c01bb6b6..2f258aa3 100644
--- a/pand/main.c
+++ b/pand/main.c
@@ -188,7 +188,9 @@ static int do_listen(void)
 
 	while (!terminate) {
 		socklen_t alen = sizeof(l2a);
+		char devname[16];
 		int nsk;
+
 		nsk = accept(sk, (struct sockaddr *) &l2a, &alen);
 		if (nsk < 0) {
 			syslog(LOG_ERR, "Accept failed. %s(%d)",
@@ -207,14 +209,17 @@ static int do_listen(void)
 			continue;
 		}
 
-		if (!bnep_accept_connection(nsk, role, netdev)) {
+		strncpy(devname, netdev, 16);
+		devname[15] = '\0';
+
+		if (!bnep_accept_connection(nsk, role, devname)) {
 			char str[40];
 			ba2str(&l2a.l2_bdaddr, str);
 
 			syslog(LOG_INFO, "New connection from %s %s",
 								str, netdev);
 
-			run_devup(netdev, str, sk, nsk);
+			run_devup(devname, str, sk, nsk);
 		} else {
 			syslog(LOG_ERR, "Connection failed. %s(%d)",
 						strerror(errno), errno);
@@ -624,7 +629,8 @@ int main(int argc, char **argv)
 			break;
 
 		case 'e':
-			strcpy(netdev, optarg);
+			strncpy(netdev, optarg, 16);
+			netdev[15] = '\0';
 			break;
 
 		case 'n':
-- 
cgit