Skip to content

Commit 3d1b6f6

Browse files
committed
Mariabackup: Ensure NUL termination in strncpy()
1 parent 630199e commit 3d1b6f6

File tree

2 files changed

+9
-5
lines changed

2 files changed

+9
-5
lines changed

extra/mariabackup/backup_copy.cc

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2352,7 +2352,8 @@ static void rocksdb_copy_back() {
23522352
return;
23532353
char rocksdb_home_dir[FN_REFLEN];
23542354
if (xb_rocksdb_datadir && is_abs_path(xb_rocksdb_datadir)) {
2355-
strncpy(rocksdb_home_dir, xb_rocksdb_datadir, sizeof(rocksdb_home_dir));
2355+
strncpy(rocksdb_home_dir, xb_rocksdb_datadir, sizeof rocksdb_home_dir - 1);
2356+
rocksdb_home_dir[sizeof rocksdb_home_dir - 1] = '\0';
23562357
} else {
23572358
snprintf(rocksdb_home_dir, sizeof(rocksdb_home_dir), "%s/%s", mysql_data_home,
23582359
xb_rocksdb_datadir?trim_dotslash(xb_rocksdb_datadir): ROCKSDB_BACKUP_DIR);

extra/mariabackup/xtrabackup.cc

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2550,8 +2550,9 @@ xtrabackup_copy_datafile(fil_node_t* node, uint thread_n, const char *dest_name=
25502550
goto error;
25512551
}
25522552

2553-
strncpy(dst_name, (dest_name)?dest_name : cursor.rel_path, sizeof(dst_name));
2554-
2553+
strncpy(dst_name, dest_name ? dest_name : cursor.rel_path,
2554+
sizeof dst_name - 1);
2555+
dst_name[sizeof dst_name - 1] = '\0';
25552556

25562557
/* Setup the page write filter */
25572558
if (xtrabackup_incremental) {
@@ -2871,7 +2872,8 @@ static void dbug_mariabackup_event(const char *event,const char *key)
28712872
if (slash)
28722873
*slash = '_';
28732874
} else {
2874-
strncpy(envvar, event, sizeof(envvar));
2875+
strncpy(envvar, event, sizeof envvar - 1);
2876+
envvar[sizeof envvar - 1] = '\0';
28752877
}
28762878
char *sql = getenv(envvar);
28772879
if (sql) {
@@ -4536,7 +4538,8 @@ void backup_fix_ddl(void)
45364538
const char *extension = is_remote ? ".isl" : ".ibd";
45374539
name.append(extension);
45384540
char buf[FN_REFLEN];
4539-
strncpy(buf, name.c_str(), sizeof(buf));
4541+
strncpy(buf, name.c_str(), sizeof buf - 1);
4542+
buf[sizeof buf - 1] = '\0';
45404543
const char *dbname = buf;
45414544
char *p = strchr(buf, '/');
45424545
if (p == 0) {

0 commit comments

Comments
 (0)