From 4692eff0d0561807c5e064b06ced6191dc6fbbda Mon Sep 17 00:00:00 2001
From: deraadt <>
Date: Fri, 4 Apr 2003 18:34:45 +0000
Subject: incorrect bounds limit; spotted by ho

---
 src/lib/libssl/src/apps/x509.c | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

(limited to 'src/lib')

diff --git a/src/lib/libssl/src/apps/x509.c b/src/lib/libssl/src/apps/x509.c
index 3ff4b62481..bc280d2c39 100644
--- a/src/lib/libssl/src/apps/x509.c
+++ b/src/lib/libssl/src/apps/x509.c
@@ -1026,24 +1026,26 @@ static ASN1_INTEGER *load_serial(char *CAfile, char *serialfile, int create)
 	ASN1_INTEGER *bs = NULL, *bs2 = NULL;
 	BIO *io = NULL;
 	BIGNUM *serial = NULL;
+	size_t len;
 
-	buf=OPENSSL_malloc( ((serialfile == NULL)
-			?(strlen(CAfile)+strlen(POSTFIX)+1)
-			:(strlen(serialfile)))+1);
+	len = ((serialfile == NULL)
+		?(strlen(CAfile)+strlen(POSTFIX)+1)
+		:(strlen(serialfile)))+1);
+	buf=OPENSSL_malloc(len);
 	if (buf == NULL) { BIO_printf(bio_err,"out of mem\n"); goto end; }
 	if (serialfile == NULL)
 		{
-		strlcpy(buf,CAfile,sizeof buf);
+		strlcpy(buf,CAfile,len);
 		for (p=buf; *p; p++)
 			if (*p == '.')
 				{
 				*p='\0';
 				break;
 				}
-		strcat(buf,POSTFIX);
+		strlcat(buf,POSTFIX,len);
 		}
 	else
-		strlcpy(buf,serialfile,sizeof buf);
+		strlcpy(buf,serialfile,len);
 	serial=BN_new();
 	bs=ASN1_INTEGER_new();
 	if ((serial == NULL) || (bs == NULL))
-- 
cgit v1.2.3-55-g6feb