Fix buffer overflows noted by Gerardo Puga

 -Erik

1 files changed, 20 insertions, 14 deletions

diff --git a/modutils/insmod.c b/modutils/insmod.c
index cab2cc204..c89cd3c8d 100644
--- a/modutils/insmod.c
+++ b/modutils/insmod.c
@@ -233,7 +233,7 @@
 #ifndef MODUTILS_MODULE_H
 static const int MODUTILS_MODULE_H = 1;
 
-#ident "$Id: insmod.c,v 1.83 2002/05/24 06:50:15 andersen Exp $"
+#ident "$Id: insmod.c,v 1.84 2002/06/06 14:24:57 andersen Exp $"
 
 /* This file contains the structures used by the 2.0 and 2.1 kernels.
    We do not use the kernel headers directly because we do not wish
@@ -454,7 +454,7 @@ int delete_module(const char *);
 #ifndef MODUTILS_OBJ_H
 static const int MODUTILS_OBJ_H = 1;
 
-#ident "$Id: insmod.c,v 1.83 2002/05/24 06:50:15 andersen Exp $"
+#ident "$Id: insmod.c,v 1.84 2002/06/06 14:24:57 andersen Exp $"
 
 /* The relocatable object is manipulated using elfin types.  */
 
@@ -3426,7 +3426,7 @@ extern int insmod_main( int argc, char **argv)
         int k_crcs;
         int k_new_syscalls;
         int len;
-        char *tmp;
+        char *tmp, *tmp1;
         unsigned long m_size;
         ElfW(Addr) m_addr;
         FILE *fp;
@@ -3464,7 +3464,7 @@ extern int insmod_main( int argc, char **argv)
                                 flag_export = 0;
                                 break;
                         case 'o':                       /* name the output module */
-                                strncpy(m_name, optarg, FILENAME_MAX);
+                                safe_strncpy(m_name, optarg, sizeof(m_name));
                                 break;
                         case 'L':                       /* Stub warning */
                                 /* This is needed for compatibility with modprobe.
@@ -3482,20 +3482,26 @@ extern int insmod_main( int argc, char **argv)
         }
 
         /* Grab the module name */
-        if ((tmp = strrchr(argv[optind], '/')) != NULL) {
-                tmp++;
-        } else {
-                tmp = argv[optind];
-        }
+        tmp1 = xstrdup(argv[optind]);
+        tmp = basename(tmp1);
         len = strlen(tmp);
 
-        if (len > 2 && tmp[len - 2] == '.' && tmp[len - 1] == 'o')
-                len -= 2;
-        memcpy(m_fullName, tmp, len);
-        m_fullName[len]='\0';
+        if (len > 2 && tmp[len - 2] == '.' && tmp[len - 1] == 'o') {
+                len-=2;
+                tmp[len] = '\0';
+        }
+        if (len >= sizeof(m_fullName)) {
+                len = sizeof(m_fullName);
+        }
+        safe_strncpy(m_fullName, tmp, len);
+        if (tmp1)
+                free(tmp1);
         if (*m_name == '\0') {
-                strcpy(m_name, m_fullName);
+                safe_strncpy(m_name, m_fullName, sizeof(m_name));
         }
+        len = strlen(m_fullName);
+        if (len > (sizeof(m_fullName)-3))
+                error_msg_and_die("%s: no module by that name found", m_fullName);
         strcat(m_fullName, ".o");
 
         /* Get a filedesc for the module.  Check we we have a complete path */