svn commit: r319217 - in stable/11: usr.bin/mkuzip usr.sbin/pw

[Alan Somers]

Author: asomers
Date: Tue May 30 15:18:22 2017
New Revision: 319217
URL: https://svnweb.freebsd.org/changeset/base/319217

Log:
  MFC r318141, r318143-r318144
  
  r318141:
  strcpy => strlcpy
  
  Reported by:	Coverity
  CID:		1352771
  Sponsored by:	Spectra Logic Corp
  
  r318143:
  strcpy => strlcpy
  
  Reported by:	Coverity
  CID:		1006715
  Sponsored by:	Spectra Logic Corp
  
  r318144:
  Don't depend on assert(3) getting evaluated
  
  Reported by:	imp
  X-MFC-With:	318141, 318143
  Sponsored by:	Spectra Logic Corp

Modified:
  stable/11/usr.bin/mkuzip/mkuzip.c
  stable/11/usr.sbin/pw/pw_user.c
Directory Properties:
  stable/11/   (props changed)

Modified: stable/11/usr.bin/mkuzip/mkuzip.c
==============================================================================
--- stable/11/usr.bin/mkuzip/mkuzip.c	Tue May 30 14:50:28 2017	(r319216)
+++ stable/11/usr.bin/mkuzip/mkuzip.c	Tue May 30 15:18:22 2017	(r319217)
@@ -108,7 +108,7 @@ int main(int argc, char **argv)
 	struct mkuz_conveyor *cvp;
         void *c_ctx;
 	struct mkuz_blk_info *chit;
-	size_t ncpusz, ncpu;
+	size_t ncpusz, ncpu, magiclen;
 	double st, et;
 
 	st = getdtime();
@@ -192,7 +192,8 @@ int main(int argc, char **argv)
 		/* Not reached */
 	}
 
-	strcpy(hdr.magic, cfs.handler->magic);
+	magiclen = strlcpy(hdr.magic, cfs.handler->magic, sizeof(hdr.magic));
+	assert(magiclen < sizeof(hdr.magic));
 
 	if (cfs.en_dedup != 0) {
 		hdr.magic[CLOOP_OFS_VERSN] = CLOOP_MAJVER_3;

Modified: stable/11/usr.sbin/pw/pw_user.c
==============================================================================
--- stable/11/usr.sbin/pw/pw_user.c	Tue May 30 14:50:28 2017	(r319216)
+++ stable/11/usr.sbin/pw/pw_user.c	Tue May 30 15:18:22 2017	(r319217)
@@ -33,6 +33,7 @@ static const char rcsid[] =
 #include <sys/param.h>
 #include <sys/types.h>
 
+#include <assert.h>
 #include <ctype.h>
 #include <dirent.h>
 #include <err.h>
@@ -490,6 +491,7 @@ pw_pwcrypt(char *password)
 	char            salt[SALTSIZE + 1];
 	char		*cryptpw;
 	static char     buf[256];
+	size_t		pwlen;
 
 	/*
 	 * Calculate a salt value
@@ -501,7 +503,9 @@ pw_pwcrypt(char *password)
 	cryptpw = crypt(password, salt);
 	if (cryptpw == NULL)
 		errx(EX_CONFIG, "crypt(3) failure");
-	return strcpy(buf, cryptpw);
+	pwlen = strlcpy(buf, cryptpw, sizeof(buf));
+	assert(pwlen < sizeof(buf));
+	return (buf);
 }
 
 static char *