fix: fix issues reported by flawfinder

ICS-MU · May 31, 2021 · 019f24b · 019f24b
1 parent e9fe5d6
commit 019f24b
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 5 deletions.
diff --git a/src/include/ldapquery.c b/src/include/ldapquery.c
@@ -29,11 +29,10 @@ int ldap_check_attr(const char *host, const char *basedn, const char *user,
     return LDAPQUERY_ERROR;
   }
 
-  passwd_local =
-      (char *)malloc(strlen(passwd) + 1);  // NOLINT(readability/casting)
-  strcpy(passwd_local, passwd);            // NOLINT(runtime/printf)
+  passwd_local = (char *)malloc(sizeof(passwd));  // NOLINT(readability/casting)
+  snprintf(passwd_local, sizeof(passwd), "%s", passwd);
   cred.bv_val = passwd_local;
-  cred.bv_len = strlen(passwd);
+  cred.bv_len = sizeof(passwd) - 1;
   rc = ldap_sasl_bind_s(ld, user, LDAP_SASL_SIMPLE, &cred, NULL, NULL,
                         &servercredp);
   free(passwd_local);

diff --git a/src/pam_oauth2_device.cpp b/src/pam_oauth2_device.cpp
@@ -313,8 +313,11 @@ bool is_authorized(Config *config, const char *username_local,
   // Try to authorize against LDAP
   if (!config->ldap_hosts.empty()) {
     size_t filter_length =
-        config->ldap_filter.length() + strlen(username_remote) + 1;
+        config->ldap_filter.length() + sizeof(username_remote);
     char *filter = new char[filter_length];
+    // Ignore `format` error, `ldap_filter` value is defined in the config
+    // file by a privilaged user.
+    // Flawfinder: ignore
     snprintf(filter, filter_length, config->ldap_filter.c_str(),
              username_remote);
     for (auto ldap_host : config->ldap_hosts) {