Patchwork [1,of,2] osutil: stop using strcpy

login
register
mail settings
Submitter Augie Fackler
Date March 20, 2016, 12:21 a.m.
Message ID <e09de2f7fe03ba5cb0ba.1458433302@augie-macbookair2.roam.corp.google.com>
Download mbox | patch
Permalink /patch/13968/
State Accepted
Headers show

Comments

Augie Fackler - March 20, 2016, 12:21 a.m.
# HG changeset patch
# User Augie Fackler <augie@google.com>
# Date 1458432139 14400
#      Sat Mar 19 20:02:19 2016 -0400
# Node ID e09de2f7fe03ba5cb0ba387dee866ffae00bb922
# Parent  2e0a3cbabdb7d68e04da1cb9982e98edec2eacef
osutil: stop using strcpy

strcpy is a security vulnerability masquerading as a utility
function. Replace it with memcpy since we know how much to copy
anyway.

Patch

diff --git a/mercurial/osutil.c b/mercurial/osutil.c
--- a/mercurial/osutil.c
+++ b/mercurial/osutil.c
@@ -203,14 +203,15 @@  static PyObject *_listdir(char *path, in
 		PyErr_NoMemory();
 		goto error_nomem;
 	}
-	strcpy(pattern, path);
+	memcpy(pattern, path, plen);
 
 	if (plen > 0) {
 		char c = path[plen-1];
 		if (c != ':' && c != '/' && c != '\\')
 			pattern[plen++] = '\\';
 	}
-	strcpy(pattern + plen, "*");
+	pattern[plen++] = '*';
+	pattern[plen] = '\0';
 
 	fh = FindFirstFileA(pattern, &fd);
 	if (fh == INVALID_HANDLE_VALUE) {