Check snprintf(3) return value for error or truncation.

Mostly path construction, where truncation could be bad.

ok and input from deraadt@ millert@ ray@

1 files changed, 5 insertions, 1 deletions

diff --git a/src/lib/libc/net/rcmd.c b/src/lib/libc/net/rcmd.c
index e2b9199492..30ca6710c4 100644
--- a/src/lib/libc/net/rcmd.c
+++ b/src/lib/libc/net/rcmd.c
@@ -382,10 +382,14 @@ again:
                 (void)fclose(hostf);
         }
         if (first == 1 && (__check_rhosts_file || superuser)) {
+                int len;
+
                 first = 0;
                 if ((pwd = getpwnam(luser)) == NULL)
                         return (-1);
-                snprintf(pbuf, sizeof pbuf, "%s/.rhosts", pwd->pw_dir);
+                len = snprintf(pbuf, sizeof pbuf, "%s/.rhosts", pwd->pw_dir);
+                if (len < 0 || len >= sizeof pbuf)
+                        return (-1);
 
                 /*
                  * Change effective uid while opening .rhosts.  If root and