fix strlcpy abuse in pax - this commit turns potential overflows into

potential non-spec compliance - the use of these fields as strings needs
to be revisited more thouroughly.
ok millert@ otto@

4 files changed, 19 insertions, 8 deletions

diff --git a/bin/pax/ftree.c b/bin/pax/ftree.c
index 76284eeb74b..ad5e11baef6 100644
--- a/bin/pax/ftree.c
+++ b/bin/pax/ftree.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ftree.c,v 1.25 2004/04/16 22:50:23 deraadt Exp $	*/
+/*	$OpenBSD: ftree.c,v 1.26 2005/04/21 21:47:18 beck Exp $	*/
 /*	$NetBSD: ftree.c,v 1.4 1995/03/21 09:07:21 cgd Exp $	*/
 
 /*-
@@ -38,7 +38,7 @@
 #if 0
 static const char sccsid[] = "@(#)ftree.c	8.2 (Berkeley) 4/18/94";
 #else
-static const char rcsid[] = "$OpenBSD: ftree.c,v 1.25 2004/04/16 22:50:23 deraadt Exp $";
+static const char rcsid[] = "$OpenBSD: ftree.c,v 1.26 2005/04/21 21:47:18 beck Exp $";
 #endif
 #endif /* not lint */
 
@@ -494,6 +494,8 @@ next_file(ARCHD *arcn)
 	 * copy file name, set file name length
 	 */
 	arcn->nlen = strlcpy(arcn->name, ftent->fts_path, sizeof(arcn->name));
+	if (arcn->nlen >= sizeof(arcn->name))
+		arcn->nlen = sizeof(arcn->name) - 1; /* XXX truncate? */
 	arcn->org_name = ftent->fts_path;
 	return(0);
 }
diff --git a/bin/pax/pat_rep.c b/bin/pax/pat_rep.c
index ce4a2afa2bb..6e3d10bc4c8 100644
--- a/bin/pax/pat_rep.c
+++ b/bin/pax/pat_rep.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: pat_rep.c,v 1.28 2004/06/11 03:10:43 millert Exp $	*/
+/*	$OpenBSD: pat_rep.c,v 1.29 2005/04/21 21:47:18 beck Exp $	*/
 /*	$NetBSD: pat_rep.c,v 1.4 1995/03/21 09:07:33 cgd Exp $	*/
 
 /*-
@@ -38,7 +38,7 @@
 #if 0
 static const char sccsid[] = "@(#)pat_rep.c	8.2 (Berkeley) 4/18/94";
 #else
-static const char rcsid[] = "$OpenBSD: pat_rep.c,v 1.28 2004/06/11 03:10:43 millert Exp $";
+static const char rcsid[] = "$OpenBSD: pat_rep.c,v 1.29 2005/04/21 21:47:18 beck Exp $";
 #endif
 #endif /* not lint */
 
@@ -750,6 +750,8 @@ tty_rename(ARCHD *arcn)
 	tty_prnt("Processing continues, name changed to: %s\n", tmpname);
 	res = add_name(arcn->name, arcn->nlen, tmpname);
 	arcn->nlen = strlcpy(arcn->name, tmpname, sizeof(arcn->name));
+	if (arcn->nlen >= sizeof(arcn->name))
+		arcn->nlen = sizeof(arcn->name) - 1; /* XXX truncate? */
 	if (res < 0)
 		return(-1);
 	return(0);
diff --git a/bin/pax/tables.c b/bin/pax/tables.c
index 6fc1446e127..425a8be05e8 100644
--- a/bin/pax/tables.c
+++ b/bin/pax/tables.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: tables.c,v 1.22 2004/11/29 16:23:22 otto Exp $	*/
+/*	$OpenBSD: tables.c,v 1.23 2005/04/21 21:47:18 beck Exp $	*/
 /*	$NetBSD: tables.c,v 1.4 1995/03/21 09:07:45 cgd Exp $	*/
 
 /*-
@@ -38,7 +38,7 @@
 #if 0
 static const char sccsid[] = "@(#)tables.c	8.1 (Berkeley) 5/31/93";
 #else
-static const char rcsid[] = "$OpenBSD: tables.c,v 1.22 2004/11/29 16:23:22 otto Exp $";
+static const char rcsid[] = "$OpenBSD: tables.c,v 1.23 2005/04/21 21:47:18 beck Exp $";
 #endif
 #endif /* not lint */
 
@@ -171,6 +171,9 @@ chk_lnk(ARCHD *arcn)
 			 */
 			arcn->ln_nlen = strlcpy(arcn->ln_name, pt->name,
 				sizeof(arcn->ln_name));
+			/* XXX truncate? */
+			if (arcn->nlen >= sizeof(arcn->name))
+				arcn->nlen = sizeof(arcn->name) - 1;
 			if (arcn->type == PAX_REG)
 				arcn->type = PAX_HRG;
 			else
@@ -601,6 +604,8 @@ sub_name(char *oname, int *onamelen, size_t onamesize)
 			 * and return (we know that oname has enough space)
 			 */
 			*onamelen = strlcpy(oname, pt->nname, onamesize);
+			if (*onamelen >= onamesize)
+				*onamelen = onamesize - 1; /* XXX truncate? */
 			return;
 		}
 		pt = pt->fow;
diff --git a/bin/pax/tar.c b/bin/pax/tar.c
index 50b1585ef50..1583048ebb9 100644
--- a/bin/pax/tar.c
+++ b/bin/pax/tar.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: tar.c,v 1.36 2005/04/14 08:24:09 markus Exp $	*/
+/*	$OpenBSD: tar.c,v 1.37 2005/04/21 21:47:18 beck Exp $	*/
 /*	$NetBSD: tar.c,v 1.5 1995/03/21 09:07:49 cgd Exp $	*/
 
 /*-
@@ -38,7 +38,7 @@
 #if 0
 static const char sccsid[] = "@(#)tar.c	8.2 (Berkeley) 4/18/94";
 #else
-static const char rcsid[] = "$OpenBSD: tar.c,v 1.36 2005/04/14 08:24:09 markus Exp $";
+static const char rcsid[] = "$OpenBSD: tar.c,v 1.37 2005/04/21 21:47:18 beck Exp $";
 #endif
 #endif /* not lint */
 
@@ -764,6 +764,8 @@ ustar_rd(ARCHD *arcn, char *buf)
 	dest = arcn->name;
 	if (*(hd->prefix) != '\0') {
 		cnt = strlcpy(dest, hd->prefix, sizeof(arcn->name) - 1);
+		if (cnt >= sizeof(arcn->name) - 1)
+			cnt = sizeof(arcn->name) - 2; /* XXX truncate? */
 		dest += cnt;
 		*dest++ = '/';
 		cnt++;