From a87abc7070dee4b7896c3c499bc3f0ba0a600b5a Mon Sep 17 00:00:00 2001 From: Ben Noordhuis Date: Fri, 13 Jul 2012 15:03:37 +0200 Subject: [PATCH] unix: avoid buffer overflow in proctitle.c Get/set process title with uv_strlcpy(), not strncpy(). The latter won't zero-terminate the result if the destination buffer is too small. --- src/unix/proctitle.c | 14 ++------------ 1 file changed, 2 insertions(+), 12 deletions(-) diff --git a/src/unix/proctitle.c b/src/unix/proctitle.c index 616501fb..29099710 100644 --- a/src/unix/proctitle.c +++ b/src/unix/proctitle.c @@ -81,22 +81,12 @@ char** uv_setup_args(int argc, char** argv) { uv_err_t uv_set_process_title(const char* title) { - /* No need to terminate, last char is always '\0'. */ - if (process_title.len) - strncpy(process_title.str, title, process_title.len - 1); - + uv_strlcpy(process_title.str, title, process_title.len); return uv_ok_; } uv_err_t uv_get_process_title(char* buffer, size_t size) { - if (process_title.str) { - strncpy(buffer, process_title.str, size); - } else { - if (size > 0) { - buffer[0] = '\0'; - } - } - + uv_strlcpy(buffer, process_title.str ? process_title.str : "", size); return uv_ok_; }