diff options
| -rw-r--r-- | apps/ChangeLog.txt | 2 | ||||
| -rw-r--r-- | apps/nshlib/nsh_telnetd.c | 4 |
2 files changed, 4 insertions, 2 deletions
diff --git a/apps/ChangeLog.txt b/apps/ChangeLog.txt index 36a7fbc5c..29bab006a 100644 --- a/apps/ChangeLog.txt +++ b/apps/ChangeLog.txt @@ -842,4 +842,6 @@ (2014-2-20). * nshlib/Kconfig: Use CONFIG_DEFAULT_SMALL in selecting default settings (2014-2-20). + * nshlib/nsh_telnetd.c: Use strncpy vs strcpy to avoid overrun the + username and password buffers. From Bertold Van den Bergh (2014-2-22). diff --git a/apps/nshlib/nsh_telnetd.c b/apps/nshlib/nsh_telnetd.c index 76ed81086..b3e67b87c 100644 --- a/apps/nshlib/nsh_telnetd.c +++ b/apps/nshlib/nsh_telnetd.c @@ -131,7 +131,7 @@ int nsh_telnetlogin(struct console_stdio_s *pstate) fflush(pstate->cn_outstream); if (fgets(pstate->cn_line, CONFIG_NSH_LINELEN, INSTREAM(pstate)) != NULL) { - strcpy(username, pstate->cn_line); + strncpy(username, pstate->cn_line, sizeof(username)); username[strlen(pstate->cn_line) - 1] = 0; } @@ -144,7 +144,7 @@ int nsh_telnetlogin(struct console_stdio_s *pstate) { /* Verify the username and password */ - strcpy(password,pstate->cn_line); + strncpy(password, pstate->cn_line, sizeof(password)); password[strlen(pstate->cn_line) - 1] = 0; if (strcmp(password, CONFIG_NSH_TELNET_PASSWORD) == 0 && |