sens: use strncat and strncpy when composing the command buffer

Avoid buffer overflows when composing the command buffer by using
strncat and strncpy.

Change-Id: Ic0ad357168c230496e9358c877b7a01345cc53f3
Signed-off-by: Octavian Purdila <octavian.purdila@intel.com>

diff --git a/sens.c b/sens.c
index 3438839..c47d21b 100644 (file)
--- a/sens.c
+++ b/sens.c
@@ -529,9 +529,13 @@ int main(int argc, char **argv)
                return start_hal(argc, argv);
        }
 
-       strcpy(cmd, argv[1]); strcat(cmd, " ");
+       if (strlen(argv[1]) >= sizeof(cmd))
+               return usage();
+       strncpy(cmd, argv[1], sizeof(cmd) - 1);
+       strncat(cmd, " ", sizeof(cmd) - strlen(cmd) - 1);
        for(i = 2; i < argc; i++) {
-               strcat(cmd, argv[i]); strcat(cmd, " ");
+               strncat(cmd, argv[i], sizeof(cmd) - strlen(cmd) - 1);
+               strncat(cmd, " ", sizeof(cmd) - strlen(cmd) - 1);
        }
 
        sock = socket(AF_UNIX, SOCK_SEQPACKET, 0);