@@ -303,7 +303,7 @@ int FindUnixPipes(void) {
303303/* */
304304/************************************************************************/
305305
306- static int FindAvailablePty (char * Slave ) {
306+ static int FindAvailablePty (char * Slave , size_t SlaveLen ) {
307307 int res ;
308308
309309 res = posix_openpt (O_RDWR );
@@ -313,7 +313,7 @@ static int FindAvailablePty(char *Slave) {
313313 }
314314 grantpt (res );
315315 unlockpt (res );
316- strcpy (Slave , ptsname (res ));
316+ strlcpy (Slave , ptsname (res ), SlaveLen );
317317 DBPRINT (("slave pty name is %s.\n" , Slave ));
318318
319319 if (res != -1 ) {
@@ -392,7 +392,7 @@ LispPTR Unix_handlecomm(LispPTR *args) {
392392 PipeName = build_socket_pathname (sockFD );
393393 memset (& sock , 0 , sizeof (sock ));
394394 sock .sun_family = AF_UNIX ;
395- strcpy (sock .sun_path , PipeName );
395+ strlcpy (sock .sun_path , PipeName , sizeof ( sock . sun_path ) );
396396 if (bind (sockFD , (struct sockaddr * )& sock , sizeof (struct sockaddr_un )) < 0 ) {
397397 close (sockFD );
398398 perror ("binding sockets" );
@@ -570,7 +570,7 @@ LispPTR Unix_handlecomm(LispPTR *args) {
570570 int Master ;
571571 unsigned short len ;
572572
573- Master = FindAvailablePty (SlavePTY );
573+ Master = FindAvailablePty (SlavePTY , sizeof ( SlavePTY ) );
574574 DBPRINT (("Fork Shell; Master PTY = %d. Slave=%c%c.\n" , Master , SlavePTY [0 ], SlavePTY [1 ]));
575575 if (Master < 0 ) {
576576 printf ("Open of lisp side of PTY failed.\n" );
@@ -771,6 +771,7 @@ LispPTR Unix_handlecomm(LispPTR *args) {
771771 {
772772 int sockFD ;
773773 struct sockaddr_un sock ;
774+ size_t pathsize ;
774775
775776 /* First open the socket */
776777 sockFD = socket (AF_UNIX , SOCK_STREAM , 0 );
@@ -782,12 +783,13 @@ LispPTR Unix_handlecomm(LispPTR *args) {
782783 socket into it */
783784 /* need to type-check the string here */
784785 LispStringToCString (args [1 ], shcom , 2048 );
785- UJ [sockFD ].pathname = malloc (strlen (shcom ) + 1 );
786- strcpy (UJ [sockFD ].pathname , shcom );
786+ pathsize = strlen (shcom ) + 1 ;
787+ UJ [sockFD ].pathname = malloc (pathsize );
788+ strlcpy (UJ [sockFD ].pathname , shcom , pathsize );
787789 /* Then bind it to the pathname, and get it listening properly */
788790
789791 sock .sun_family = AF_UNIX ;
790- strcpy (sock .sun_path , shcom );
792+ strlcpy (sock .sun_path , shcom , sizeof ( sock . sun_path ) );
791793 if (bind (sockFD , (struct sockaddr * )& sock , sizeof (struct sockaddr_un )) < 0 ) {
792794 close (sockFD );
793795 free (UJ [sockFD ].pathname );
0 commit comments