Force nul-termination of strings after vsnprintf().

Apparently, on Windows this function might not always be properly
terminated.

diff --git a/src/bsd/tunemu.c b/src/bsd/tunemu.c
index 1ce9007491fd377d20b11d01142b9c6845be4690..d2b9f3d93a276c9fc48d9befc37e491c6d4a2115 100644 (file)
--- a/src/bsd/tunemu.c
+++ b/src/bsd/tunemu.c
@@ -87,7 +87,7 @@ static void tun_error(char *format, ...)
 {
        va_list vl;
        va_start(vl, format);
-       vsnprintf(tunemu_error, ERROR_BUFFER_SIZE, format, vl);
+       vsnprintf(tunemu_error, sizeof tunemu_error, format, vl);
        va_end(vl);
 }
 

diff --git a/src/dropin.c b/src/dropin.c
index fe3b7ef218ae79c8827388a19d10f1755d2c9528..c7b558a4288bad7a06041ab575ad47b3a86b8300 100644 (file)
--- a/src/dropin.c
+++ b/src/dropin.c
@@ -106,6 +106,7 @@ int vasprintf(char **buf, const char *fmt, va_list ap) {
 
        va_copy(aq, ap);
        status = vsnprintf(*buf, len, fmt, aq);
+       buf[len - 1] = 0;
        va_end(aq);
 
        if(status >= 0)

diff --git a/src/logger.c b/src/logger.c
index e46d926f42dac76dd98f3a21774da44cc6a4463b..6028e3d00cd008296724ab22ee97151e8f6204f1 100644 (file)
--- a/src/logger.c
+++ b/src/logger.c
@@ -110,20 +110,22 @@ void logger(int level, int priority, const char *format, ...) {
 
        va_start(ap, format);
        int len = vsnprintf(message, sizeof message, format, ap);
+       message[sizeof message - 1] = 0;
        va_end(ap);
 
-       if(len > 0 && len < sizeof message && message[len - 1] == '\n')
+       if(len > 0 && len < sizeof message - 1 && message[len - 1] == '\n')
                message[len - 1] = 0;
 
        real_logger(level, priority, message);
 }
 
 static void sptps_logger(sptps_t *s, int s_errno, const char *format, va_list ap) {
-       char message[1024] = "";
+       char message[1024];
        size_t msglen = sizeof message;
 
        int len = vsnprintf(message, msglen, format, ap);
-       if(len > 0 && len < sizeof message) {
+       message[sizeof message - 1] = 0;
+       if(len > 0 && len < sizeof message - 1) {
                if(message[len - 1] == '\n')
                        message[--len] = 0;
 

diff --git a/src/protocol.c b/src/protocol.c
index f533a932c6e94dfee216073260db53e0155e59ae..b9abccc3566e34bb0f3b3cb804921c4998e4e455 100644 (file)
--- a/src/protocol.c
+++ b/src/protocol.c
@@ -72,10 +72,11 @@ bool send_request(connection_t *c, const char *format, ...) {
           input buffer anyway */
 
        va_start(args, format);
-       len = vsnprintf(request, MAXBUFSIZE, format, args);
+       len = vsnprintf(request, sizeof request, format, args);
+       request[sizeof request - 1] = 0;
        va_end(args);
 
-       if(len < 0 || len > MAXBUFSIZE - 1) {
+       if(len < 0 || len > sizeof request - 1) {
                logger(DEBUG_ALWAYS, LOG_ERR, "Output buffer overflow while sending request to %s (%s)",
                           c->name, c->hostname);
                return false;

diff --git a/src/tincctl.c b/src/tincctl.c
index 9f9df6f656e1aba603be92dd93eb12542df9bfb6..a0a7633df516a964d08d1a0ad42c986e5ebbe142 100644 (file)
--- a/src/tincctl.c
+++ b/src/tincctl.c
@@ -560,6 +560,7 @@ bool sendline(int fd, char *format, ...) {
 
        va_start(ap, format);
        blen = vsnprintf(buffer, sizeof buffer, format, ap);
+       buffer[sizeof buffer - 1] = 0;
        va_end(ap);
 
        if(blen < 1 || blen >= sizeof buffer)
@@ -885,7 +886,7 @@ static int cmd_start(int argc, char *argv[]) {
 
        if(!pid) {
                close(pfd[0]);
-               char buf[100] = "";
+               char buf[100];
                snprintf(buf, sizeof buf, "%d", pfd[1]);
                setenv("TINC_UMBILICAL", buf, true);
                exit(execvp(c, nargv));