Buffer overflow in dump, as reported from Bugtraq

[dump.git] / dump / tape.c

diff --git a/dump/tape.c b/dump/tape.c
index b3964a8336512054dc957f16524c27003d928ff1..5a50ff95aaf66e814efad447026639090b8814e9 100644 (file)
--- a/dump/tape.c
+++ b/dump/tape.c
@@ -40,7 +40,7 @@
 
 #ifndef lint
 static const char rcsid[] =
-       "$Id: tape.c,v 1.12 2000/02/10 09:42:32 stelian Exp $";
+       "$Id: tape.c,v 1.14 2000/03/01 10:16:05 stelian Exp $";
 #endif /* not lint */
 
 #ifdef __linux__
@@ -715,8 +715,8 @@ restore_check_point:
                 */
                tapeno++;               /* current tape sequence */
                if (Mflag) {
-                       snprintf(tape, NAME_MAX, "%s%03d", tapeprefix, tapeno);
-                       tape[NAME_MAX - 1] = '\0';
+                       snprintf(tape, MAXPATHLEN, "%s%03d", tapeprefix, tapeno);
+                       tape[MAXPATHLEN - 1] = '\0';
                        msg("Dumping volume %d on %s\n", tapeno, tape);
                }
                else if (nexttape || strchr(tapeprefix, ',')) {
@@ -727,15 +727,16 @@ restore_check_point:
                                nexttape = p + 1;
                        } else
                                nexttape = NULL;
-                       strncpy(tape, tapeprefix, NAME_MAX);
-                       tape[NAME_MAX - 1] = '\0';
+                       strncpy(tape, tapeprefix, MAXPATHLEN);
+                       tape[MAXPATHLEN - 1] = '\0';
                        msg("Dumping volume %d on %s\n", tapeno, tape);
                }
 #ifdef RDUMP
-               while ((tapefd = (host ? rmtopen(tape, 2) :
-                       pipeout ? 1 : open(tape, O_WRONLY|O_CREAT, 0666))) < 0)
+               while ((tapefd = (host ? rmtopen(tape, 2) : pipeout ? 
+                       fileno(stdout) : 
+                       open(tape, O_WRONLY|O_CREAT, 0666))) < 0)
 #else
-               while ((tapefd = (pipeout ? 1 :
+               while ((tapefd = (pipeout ? fileno(stdout) :
                                  open(tape, O_WRONLY|O_CREAT, 0666))) < 0)
 #endif
                    {