Always terminate strncpy results.

The function strncpy does not guarantee to append a terminating
NUL character to the destination.

This patch merges libSM's way of handling this issue into libICE.

Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>

1 files changed, 48 insertions, 18 deletions

diff --git a/src/connect.c b/src/connect.c
index 086b7f3..1554ad6 100644
--- a/src/connect.c
+++ b/src/connect.c
@@ -66,8 +66,11 @@ IceOpenConnection (
 
     if (networkIdsList == NULL || *networkIdsList == '\0')
     {
-	strncpy (errorStringRet,
-	    "networkIdsList argument is NULL", errorLength);
+	if (errorStringRet && errorLength > 0) {
+	    strncpy (errorStringRet,
+		"networkIdsList argument is NULL", errorLength);
+	    errorStringRet[errorLength - 1] = '\0';
+	}
 	return (NULL);
     }
 
@@ -144,7 +147,10 @@ IceOpenConnection (
 
     if ((iceConn = malloc (sizeof (struct _IceConn))) == NULL)
     {
-	strncpy (errorStringRet, "Can't malloc", errorLength);
+	if (errorStringRet && errorLength > 0) {
+	    strncpy (errorStringRet, "Can't malloc", errorLength);
+	    errorStringRet[errorLength - 1] = '\0';
+	}
 	return (NULL);
     }
 
@@ -157,7 +163,10 @@ IceOpenConnection (
 	&iceConn->connection_string)) == NULL)
     {
 	free (iceConn);
-	strncpy (errorStringRet, "Could not open network socket", errorLength);
+	if (errorStringRet && errorLength > 0) {
+	    strncpy (errorStringRet, "Could not open network socket", errorLength);
+	    errorStringRet[errorLength - 1] = '\0';
+	}
 	return (NULL);
     }
 
@@ -195,7 +204,10 @@ IceOpenConnection (
     if ((iceConn->inbuf = iceConn->inbufptr = malloc (ICE_INBUFSIZE)) == NULL)
     {
 	_IceFreeConnection (iceConn);
-	strncpy (errorStringRet, "Can't malloc", errorLength);
+	if (errorStringRet && errorLength > 0) {
+	    strncpy (errorStringRet, "Can't malloc", errorLength);
+	    errorStringRet[errorLength - 1] = '\0';
+	}
 	return (NULL);
     }
 
@@ -204,7 +216,10 @@ IceOpenConnection (
     if ((iceConn->outbuf = iceConn->outbufptr = calloc (1, ICE_OUTBUFSIZE)) == NULL)
     {
 	_IceFreeConnection (iceConn);
-	strncpy (errorStringRet, "Can't malloc", errorLength);
+	if (errorStringRet && errorLength > 0) {
+	    strncpy (errorStringRet, "Can't malloc", errorLength);
+	    errorStringRet[errorLength - 1] = '\0';
+	}
 	return (NULL);
     }
 
@@ -257,8 +272,11 @@ IceOpenConnection (
     if (ioErrorOccured)
     {
 	_IceFreeConnection (iceConn);
-	strncpy (errorStringRet, "IO error occured opening connection",
-	     errorLength);
+	if (errorStringRet && errorLength > 0) {
+	    strncpy (errorStringRet, "IO error occured opening connection",
+		 errorLength);
+	    errorStringRet[errorLength - 1] = '\0';
+	}
 	return (NULL);
     }
 
@@ -269,9 +287,12 @@ IceOpenConnection (
 	 */
 
 	_IceFreeConnection (iceConn);
-	strncpy (errorStringRet,
-	    "Internal error - did not receive the expected ByteOrder message",
-	     errorLength);
+	if (errorStringRet && errorLength > 0) {
+	    strncpy (errorStringRet,
+		"Internal error - did not receive the expected ByteOrder "
+		"message", errorLength);
+	    errorStringRet[errorLength - 1] = '\0';
+	}
 	return (NULL);
     }
 
@@ -355,8 +376,11 @@ IceOpenConnection (
 
 	if (ioErrorOccured)
 	{
-	    strncpy (errorStringRet, "IO error occured opening connection",
-		errorLength);
+	    if (errorStringRet && errorLength > 0) {
+		strncpy (errorStringRet, "IO error occured opening connection",
+		    errorLength);
+		errorStringRet[errorLength - 1] = '\0';
+	    }
 	    _IceFreeConnection (iceConn);
 	    iceConn = NULL;
 	}
@@ -366,9 +390,12 @@ IceOpenConnection (
 	    {
 		if (reply.connection_reply.version_index >= _IceVersionCount)
 		{
-		    strncpy (errorStringRet,
-	    		"Got a bad version index in the Connection Reply",
-			errorLength);
+		    if (errorStringRet && errorLength > 0) {
+			strncpy (errorStringRet,
+			    "Got a bad version index in the Connection Reply",
+			    errorLength);
+			errorStringRet[errorLength - 1] = '\0';
+		    }
 
 		    free (reply.connection_reply.vendor);
 		    free (reply.connection_reply.release);
@@ -397,8 +424,11 @@ IceOpenConnection (
 	    {
 		/* Connection failed */
 
-		strncpy (errorStringRet, reply.connection_error.error_message,
-		    errorLength);
+		if (errorStringRet && errorLength > 0) {
+		    strncpy (errorStringRet,
+			reply.connection_error.error_message, errorLength);
+		    errorStringRet[errorLength - 1] = '\0';
+		}
 
 		free (reply.connection_error.error_message);