[Bug libc/26657] New: strncpy in login/login.c line 114 might leave the destination string unterminate

[xiechengliang1 at huawei dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=26657

            Bug ID: 26657
           Summary: strncpy in login/login.c line 114 might leave the
                    destination string unterminate
           Product: glibc
           Version: 2.31
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: libc
          Assignee: unassigned at sourceware dot org
          Reporter: xiechengliang1 at huawei dot com
                CC: drepper.fsp at gmail dot com
  Target Milestone: ---

The glibc-2.31/login/login.c 114 line contains the following code:
    strncpy (copy.ut_line, ttyp, UT_LINESIZE);

  The UT_LINESIZE size is 32 bytes，and the size of the destination array
"copy.ut_line" is also 32 bytes. The code cannot ensure that the "ttyp" ends
with '\0'. so calling "strncpy" might leave the destination string
unterminated. When strlen is used to obtain the length of the "copy.ut_line"
array, a buffer overflow occurs.

  Consider setting the 32nd bit of the "copy.ut_line" array to '\0' to fix it.

-- 
You are receiving this mail because:
You are on the CC list for the bug.