dpme_name and dpme_type are NUL-terminated in Apple code, so use

strlcpy() to fill them.

They are also supposed to be NUL-padded so zap previous contents
before copying in possibly shorter new values.

4 files changed, 26 insertions, 15 deletions

diff --git a/sbin/pdisk/dump.c b/sbin/pdisk/dump.c
index 0212f6751de..4a1d1e02d56 100644
--- a/sbin/pdisk/dump.c
+++ b/sbin/pdisk/dump.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: dump.c,v 1.55 2016/01/26 16:39:00 krw Exp $	*/
+/*	$OpenBSD: dump.c,v 1.56 2016/01/26 21:07:54 krw Exp $	*/
 
 /*
  * dump.c - dumping partition maps
@@ -130,8 +130,7 @@ dump_partition_entry(struct partition_map *entry, int type_length,
 	printf("%2ld: %*.32s", entry->disk_address, type_length, p->dpme_type);
 
 	buf = malloc(name_length + 1);
-	strncpy(buf, p->dpme_name, name_length);
-	buf[name_length] = 0;
+	strlcpy(buf, p->dpme_name, name_length+1);
 	printf("%c%-*.32s ", driver, name_length, buf);
 	free(buf);
 
diff --git a/sbin/pdisk/file_media.c b/sbin/pdisk/file_media.c
index 99c57db322c..f1f58cfd903 100644
--- a/sbin/pdisk/file_media.c
+++ b/sbin/pdisk/file_media.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: file_media.c,v 1.42 2016/01/26 16:13:09 krw Exp $	*/
+/*	$OpenBSD: file_media.c,v 1.43 2016/01/26 21:07:54 krw Exp $	*/
 
 /*
  * file_media.c -
@@ -282,11 +282,11 @@ read_dpme(int fd, uint64_t sector, struct dpme *dpme)
 	memcpy(dpme->dpme_reserved_4, dpme_ondisk->dpme_reserved_4,
 	    sizeof(dpme->dpme_reserved_4));
 
-	memcpy(dpme->dpme_name, dpme_ondisk->dpme_name,
+	strlcpy(dpme->dpme_name, dpme_ondisk->dpme_name,
 	    sizeof(dpme->dpme_name));
-	memcpy(dpme->dpme_type, dpme_ondisk->dpme_type,
+	strlcpy(dpme->dpme_type, dpme_ondisk->dpme_type,
 	    sizeof(dpme->dpme_type));
-	memcpy(dpme->dpme_processor_id, dpme_ondisk->dpme_processor_id,
+	strlcpy(dpme->dpme_processor_id, dpme_ondisk->dpme_processor_id,
 	    sizeof(dpme->dpme_processor_id));
 
 	free(dpme_ondisk);
diff --git a/sbin/pdisk/partition_map.c b/sbin/pdisk/partition_map.c
index 4493efcc4b3..6308843b30c 100644
--- a/sbin/pdisk/partition_map.c
+++ b/sbin/pdisk/partition_map.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: partition_map.c,v 1.67 2016/01/26 16:39:00 krw Exp $	*/
+/*	$OpenBSD: partition_map.c,v 1.68 2016/01/26 21:07:54 krw Exp $	*/
 
 /*
  * partition_map.c - partition map routines
@@ -277,8 +277,10 @@ create_partition_map(int fd, char *name, u_int64_t mediasz, uint32_t sectorsz)
 			dpme->dpme_map_entries = 1;
 			dpme->dpme_pblock_start = 1;
 			dpme->dpme_pblocks = map->media_size - 1;
-			strncpy(dpme->dpme_name, kFreeName, DPISTRLEN);
-			strncpy(dpme->dpme_type, kFreeType, DPISTRLEN);
+			strlcpy(dpme->dpme_name, kFreeName,
+			    sizeof(dpme->dpme_name));
+			strlcpy(dpme->dpme_type, kFreeType,
+			    sizeof(dpme->dpme_type));
 			dpme->dpme_lblock_start = 0;
 			dpme->dpme_lblocks = dpme->dpme_pblocks;
 			dpme->dpme_flags = DPME_WRITABLE | DPME_READABLE |
@@ -477,8 +479,8 @@ create_dpme(const char *name, const char *dptype, uint32_t base,
 		dpme->dpme_map_entries = 1;
 		dpme->dpme_pblock_start = base;
 		dpme->dpme_pblocks = length;
-		strncpy(dpme->dpme_name, name, DPISTRLEN);
-		strncpy(dpme->dpme_type, dptype, DPISTRLEN);
+		strlcpy(dpme->dpme_name, name, sizeof(dpme->dpme_name));
+		strlcpy(dpme->dpme_type, dptype, sizeof(dpme->dpme_type));
 		dpme->dpme_lblock_start = 0;
 		dpme->dpme_lblocks = dpme->dpme_pblocks;
 		dpme_init_flags(dpme);
diff --git a/sbin/pdisk/pdisk.c b/sbin/pdisk/pdisk.c
index a82f1f96d5b..2649e889a91 100644
--- a/sbin/pdisk/pdisk.c
+++ b/sbin/pdisk/pdisk.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: pdisk.c,v 1.70 2016/01/26 16:39:00 krw Exp $	*/
+/*	$OpenBSD: pdisk.c,v 1.71 2016/01/26 21:07:54 krw Exp $	*/
 
 /*
  * pdisk - an editor for Apple format partition tables
@@ -356,8 +356,13 @@ do_rename_partition(struct partition_map_header *map)
 	if (entry == NULL) {
 		printf("No such partition\n");
 	} else {
-		/* stuff name into partition map entry dpme */
-		strncpy(entry->dpme->dpme_name, name, DPISTRLEN);
+		/*
+		 * Since dpme_name is supposed to be NUL-filled, make sure
+		 * current contents are zapped before copying in new name!
+		 */
+		memset(entry->dpme->dpme_name, 0,
+		    sizeof(entry->dpme->dpme_name));
+		strlcpy(entry->dpme->dpme_name, name, DPISTRLEN);
 		map->changed = 1;
 	}
 	free(name);
@@ -386,6 +391,11 @@ do_change_type(struct partition_map_header *map)
 		bad_input("Bad type");
 		goto out;
 	}
+        /*
+	 * Since dpme_type is supposed to be NUL-filled, make sure
+         * current contents are zapped before copying in new type!
+	 */
+	memset(entry->dpme->dpme_type, 0, sizeof(entry->dpme->dpme_type));
 	strncpy(entry->dpme->dpme_type, type, DPISTRLEN);
 	map->changed = 1;