1 files changed, 8 insertions, 6 deletions

diff --git a/src/lib/libcrypto/dso/dso_dl.c b/src/lib/libcrypto/dso/dso_dl.c
index fc4236bd9a..c3b4f6cf45 100644
--- a/src/lib/libcrypto/dso/dso_dl.c
+++ b/src/lib/libcrypto/dso/dso_dl.c
@@ -259,18 +259,20 @@ static char *dl_merger(DSO *dso, const char *filespec1, const char *filespec2)
            same goes if the second file specification is missing. */
         if (!filespec2 || filespec1[0] == '/')
                 {
-                merged = OPENSSL_malloc(strlen(filespec1) + 1);
+                size_t len = strlen(filespec1) + 1;
+                merged = OPENSSL_malloc(len);
                 if(!merged)
                         {
                         DSOerr(DSO_F_DL_MERGER,
                                 ERR_R_MALLOC_FAILURE);
                         return(NULL);
                         }
-                strcpy(merged, filespec1);
+                memcpy(merged, filespec1, len);
                 }
         /* If the first file specification is missing, the second one rules. */
         else if (!filespec1)
                 {
+                size_t len = strlen(filespec2) + 1;
                 merged = OPENSSL_malloc(strlen(filespec2) + 1);
                 if(!merged)
                         {
@@ -278,7 +280,7 @@ static char *dl_merger(DSO *dso, const char *filespec1, const char *filespec2)
                                 ERR_R_MALLOC_FAILURE);
                         return(NULL);
                         }
-                strcpy(merged, filespec2);
+                memcpy(merged, filespec2, len);
                 }
         else
                 /* This part isn't as trivial as it looks.  It assumes that
@@ -287,7 +289,7 @@ static char *dl_merger(DSO *dso, const char *filespec1, const char *filespec2)
                    the concatenation of filespec2 followed by a slash followed
                    by filespec1. */
                 {
-                int spec2len, len;
+                size_t spec2len, len;
 
                 spec2len = (filespec2 ? strlen(filespec2) : 0);
                 len = spec2len + (filespec1 ? strlen(filespec1) : 0);
@@ -304,9 +306,9 @@ static char *dl_merger(DSO *dso, const char *filespec1, const char *filespec2)
                                 ERR_R_MALLOC_FAILURE);
                         return(NULL);
                         }
-                strcpy(merged, filespec2);
+                strlcpy(merged, filespec2, len + 2);
                 merged[spec2len] = '/';
-                strcpy(&merged[spec2len + 1], filespec1);
+                strlcpy(&merged[spec2len + 1], filespec1, 1 + len - spec2len);
                 }
         return(merged);
         }