Buffer overflow in dump, as reported from Bugtraq

[dump.git] / dump / main.c

diff --git a/dump/main.c b/dump/main.c
index 806de5efe278b990f2844d9f994f9b39d02b7cb1..553a1e66831f781e0ff628387af11ae68c6c47a0 100644 (file)
--- a/dump/main.c
+++ b/dump/main.c
@@ -40,7 +40,7 @@
 
 #ifndef lint
 static const char rcsid[] =
-       "$Id: main.c,v 1.15 2000/02/04 20:22:21 stelian Exp $";
+       "$Id: main.c,v 1.17 2000/03/01 10:16:05 stelian Exp $";
 #endif /* not lint */
 
 #include <sys/param.h>
@@ -121,8 +121,8 @@ main(int argc, char *argv[])
        ino_t maxino;
 #ifdef __linux__
        errcode_t retval;
-       char directory[NAME_MAX];
-       char pathname[NAME_MAX];
+       char directory[MAXPATHLEN];
+       char pathname[MAXPATHLEN];
 #endif
        time_t tnow;
        char labelstr[LBLSIZE];
@@ -144,7 +144,6 @@ main(int argc, char *argv[])
        if ((tapeprefix = getenv("TAPE")) == NULL)
                tapeprefix = _PATH_DEFTAPE;
        dumpdates = _PATH_DUMPDATES;
-       temp = _PATH_DTMP;
        strcpy(labelstr, "none");       /* XXX safe strcpy. */
        if (TP_BSIZE / DEV_BSIZE == 0 || TP_BSIZE % DEV_BSIZE != 0)
                quit("TP_BSIZE must be a multiple of DEV_BSIZE\n");
@@ -284,6 +283,10 @@ main(int argc, char *argv[])
                exit(X_STARTUP);
        }
        disk = *argv++;
+       if (strlen(disk) > MAXPATHLEN) {
+               (void)fprintf(stderr, "Disk or filesystem name too long: %s\n", disk);
+               exit(X_STARTUP);
+       }
        argc--;
        if (argc >= 1) {
                (void)fprintf(stderr, "Unknown arguments to dump:");
@@ -419,10 +422,10 @@ main(int argc, char *argv[])
        }
 
        if (Mflag)
-               snprintf(tape, NAME_MAX, "%s%03d", tapeprefix, tapeno + 1);
+               snprintf(tape, MAXPATHLEN, "%s%03d", tapeprefix, tapeno + 1);
        else
-               strncpy(tape, tapeprefix, NAME_MAX);
-       tape[NAME_MAX - 1] = '\0';
+               strncpy(tape, tapeprefix, MAXPATHLEN);
+       tape[MAXPATHLEN - 1] = '\0';
 
        if (!sizest) {