[Xen-devel] [PATCH 3/4] tools/xenstored: Avoid buffer overflows while setting up sockets

[Andrew Cooper <andrew.cooper3@xxxxxxxxxx>]

Coverity ID: 1055996 1056002

Use strncpy in preference to strcpy, and use the correct failing path for
error messages.

Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
CC: Ian Campbell <Ian.Campbell@xxxxxxxxxx>
CC: Ian Jackson <Ian.Jackson@xxxxxxxxxxxxx>
---
 tools/xenstore/xenstored_core.c |    9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/tools/xenstore/xenstored_core.c b/tools/xenstore/xenstored_core.c
index ccfdaa3..3c13c64 100644
--- a/tools/xenstore/xenstored_core.c
+++ b/tools/xenstore/xenstored_core.c
@@ -1735,13 +1735,12 @@ static void init_sockets(int **psock, int **pro_sock)
        unlink(xs_daemon_socket_ro());
 
        addr.sun_family = AF_UNIX;
-       strcpy(addr.sun_path, xs_daemon_socket());
+       strncpy(addr.sun_path, xs_daemon_socket(), sizeof(addr.sun_path));
        if (bind(*sock, (struct sockaddr *)&addr, sizeof(addr)) != 0)
-               barf_perror("Could not bind socket to %s", xs_daemon_socket());
-       strcpy(addr.sun_path, xs_daemon_socket_ro());
+               barf_perror("Could not bind socket to %s", addr.sun_path);
+       strncpy(addr.sun_path, xs_daemon_socket_ro(), sizeof(addr.sun_path));
        if (bind(*ro_sock, (struct sockaddr *)&addr, sizeof(addr)) != 0)
-               barf_perror("Could not bind socket to %s",
-                           xs_daemon_socket_ro());
+               barf_perror("Could not bind socket to %s", addr.sun_path);
        if (chmod(xs_daemon_socket(), 0600) != 0
            || chmod(xs_daemon_socket_ro(), 0660) != 0)
                barf_perror("Could not chmod sockets");
-- 
1.7.10.4


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel