upserver: Don't overflow file and hostname buffers

If the user specifies a ridiculously long command line, don't
overflow the filename or hostname buffers with what they supply.

Caught by coverity (#985911)

Change-Id: Ia73f9fb94491f5691358eec1d13dbdd2651a604c
Reviewed-on: http://gerrit.openafs.org/9546
Reviewed-by: Jeffrey Altman <jaltman@your-file-system.com>
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Derrick Brashear <shadow@your-file-system.com>

diff --git a/src/update/client.c b/src/update/client.c
index bdcfd52..c822d3d 100644 (file)
--- a/src/update/client.c
+++ b/src/update/client.c
@@ -177,10 +177,18 @@ main(int argc, char **argv)
                    ("Usage: upclient <hostname> [-crypt] [-clear] [-t <retry time>] [-verbose]* <dir>+ [-help]\n");
                exit(1);
            }
-       } else if (strlen(hostname) == 0)
-           strcpy(hostname, argv[a]);
-       else {
-           strcpy(filename, argv[a]);
+       } else if (strlen(hostname) == 0) {
+           if (strlcpy(hostname, argv[a], sizeof(hostname))
+                   >= sizeof(hostname)) {
+               fprintf(stderr, "Supplied hostname is too long\n");
+               exit(1);
+           }
+       } else {
+           if (strlcpy(filename, argv[a], sizeof(filename))
+                   >= sizeof(filename)) {
+               fprintf(stderr, "Supplied filename is too long\n");
+               exit(1);
+           }
            FilepathNormalize(filename);
            AddToList(&dirname, filename);
        }