Small buffer overflow in restore/tape.c

diff --git a/CHANGES b/CHANGES
index 0fd8d3d8aa7fd3e03e0289ac8ec6f1a552d3cb26..c062bca328e4d34228ff9c351137a5456dd43a0f 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,4 +1,10 @@
-$Id: CHANGES,v 1.114 2001/05/12 11:39:45 stelian Exp $
+$Id: CHANGES,v 1.115 2001/05/26 11:04:46 stelian Exp $
+
+Changes between versions 0.4b22 and 0.4b23 (released ????????????)
+==================================================================
+
+1.     Fixed a buffer overflow in restore/tape.c. Patch provided by
+       Marcus Meissner (Caldera International Security Dept.).
 
 Changes between versions 0.4b21 and 0.4b22 (released May 12, 2001)
 ==================================================================

diff --git a/restore/tape.c b/restore/tape.c
index 5fac380f1024641b4969e204f83e9961a9706f79..d7e8ed635be54041c6872d5512e64eca52d861ea 100644 (file)
--- a/restore/tape.c
+++ b/restore/tape.c
@@ -46,7 +46,7 @@
 
 #ifndef lint
 static const char rcsid[] =
-       "$Id: tape.c,v 1.38 2001/05/12 11:36:12 stelian Exp $";
+       "$Id: tape.c,v 1.39 2001/05/26 11:04:46 stelian Exp $";
 #endif /* not lint */
 
 #include <config.h>
@@ -448,8 +448,8 @@ again:
                        return;
                }
                if (buf[0] != '\n') {
-                       (void) strcpy(magtape, buf);
-                       magtape[strlen(magtape) - 1] = '\0';
+                       (void) strncpy(magtape, buf, sizeof(magtape));
+                       magtape[sizeof(magtape) - 1] = '\0';
                }
        }
 #ifdef RRESTORE