fix strncpy bounds errors

error: 'strncpy' specified bound 4096 equals destination size [-Werror=stringop-truncation]

Based on patch by Elan Ruusamäe <glen@delfi.ee>

5 files changed, 26 insertions, 6 deletions

diff --git a/libfetch/http.c b/libfetch/http.c
index 638c9a86607..5a515cbf21a 100644
--- a/libfetch/http.c
+++ b/libfetch/http.c
@@ -496,10 +496,10 @@ http_next_header(conn_t *conn, const char **p)
 static int
 http_parse_mtime(const char *p, time_t *mtime)
 {
-	char locale[64], *r;
+	char *locale, *r;
 	struct tm tm;
 
-	strncpy(locale, setlocale(LC_TIME, NULL), sizeof(locale));
+	locale = strdupa(setlocale(LC_TIME, NULL));
 	setlocale(LC_TIME, "C");
 	r = strptime(p, "%a, %d %b %Y %H:%M:%S GMT", &tm);
 	/* XXX should add support for date-2 and date-3 */
diff --git a/src/apk_blob.h b/src/apk_blob.h
index 4fdd3be639c..c14980d54a1 100644
--- a/src/apk_blob.h
+++ b/src/apk_blob.h
@@ -133,4 +133,8 @@ void apk_atom_init(void);
 apk_blob_t *apk_blob_atomize(apk_blob_t blob);
 apk_blob_t *apk_blob_atomize_dup(apk_blob_t blob);
 
+#if defined(__GLIBC__) && !defined(__UCLIBC__)
+extern size_t strlcpy(char *dest, const char *src, size_t size);
+#endif
+
 #endif
diff --git a/src/archive.c b/src/archive.c
index 1745056ad54..724410cd07a 100644
--- a/src/archive.c
+++ b/src/archive.c
@@ -387,10 +387,10 @@ int apk_tar_write_entry(struct apk_ostream *os, const struct apk_file_info *ae,
 			return -1;
 
 		if (ae->name != NULL)
-			strncpy(buf.name, ae->name, sizeof(buf.name));
+			strlcpy(buf.name, ae->name, sizeof buf.name);
 
-		strncpy(buf.uname, ae->uname ?: "root", sizeof(buf.uname));
-		strncpy(buf.gname, ae->gname ?: "root", sizeof(buf.gname));
+		strlcpy(buf.uname, ae->uname ?: "root", sizeof buf.uname);
+		strlcpy(buf.gname, ae->gname ?: "root", sizeof buf.gname);
 
 		PUT_OCTAL(buf.size, ae->size);
 		PUT_OCTAL(buf.uid, ae->uid);
diff --git a/src/blob.c b/src/blob.c
index 4bedfbc5685..7c5bc9554e3 100644
--- a/src/blob.c
+++ b/src/blob.c
@@ -717,3 +717,16 @@ apk_blob_t *apk_blob_atomize_dup(apk_blob_t blob)
 
 	return &atom->blob;
 }
+
+#if defined(__GLIBC__) && !defined(__UCLIBC__)
+size_t strlcpy(char *dst, const char *src, size_t size)
+{
+	size_t ret = strlen(src), len;
+	if (!size) return ret;
+	len = ret;
+	if (len >= size) len = size - 1;
+	memcpy(dest, src, len);
+	dst[len] = 0;
+	return ret;
+}
+#endif
diff --git a/src/database.c b/src/database.c
index 8e58785575b..5bffb433653 100644
--- a/src/database.c
+++ b/src/database.c
@@ -2787,7 +2787,10 @@ static int apk_db_unpack_pkg(struct apk_database *db,
 		if (!(pkg->repos & db->local_repos))
 			need_copy = TRUE;
 	} else {
-		strncpy(file, pkg->filename, sizeof(file));
+		if (strlcpy(file, pkg->filename, sizeof file) >= sizeof file) {
+			r = -ENAMETOOLONG;
+			goto err_msg;
+		}
 		need_copy = TRUE;
 	}
 	if (!apk_db_cache_active(db))