Force nul-termination of strings after vsnprintf().

Apparently, on Windows this function might not always be properly
terminated.

diff --git a/src/bsd/tunemu.c b/src/bsd/tunemu.c
index 1ce9007..d2b9f3d 100644 (file)
--- a/src/bsd/tunemu.c
+++ b/src/bsd/tunemu.c
@@ -87,7 +87,7 @@ static void tun_error(char *format, ...)
 {
        va_list vl;
        va_start(vl, format);
-       vsnprintf(tunemu_error, ERROR_BUFFER_SIZE, format, vl);
+       vsnprintf(tunemu_error, sizeof tunemu_error, format, vl);
        va_end(vl);
 }
 

diff --git a/src/dropin.c b/src/dropin.c
index fe3b7ef..c7b558a 100644 (file)
--- a/src/dropin.c
+++ b/src/dropin.c
@@ -106,6 +106,7 @@ int vasprintf(char **buf, const char *fmt, va_list ap) {
 
        va_copy(aq, ap);
        status = vsnprintf(*buf, len, fmt, aq);
+       buf[len - 1] = 0;
        va_end(aq);
 
        if(status >= 0)

diff --git a/src/logger.c b/src/logger.c
index e46d926..6028e3d 100644 (file)
--- a/src/logger.c
+++ b/src/logger.c
@@ -110,20 +110,22 @@ void logger(int level, int priority, const char *format, ...) {
 
        va_start(ap, format);
        int len = vsnprintf(message, sizeof message, format, ap);
+       message[sizeof message - 1] = 0;
        va_end(ap);
 
-       if(len > 0 && len < sizeof message && message[len - 1] == '\n')
+       if(len > 0 && len < sizeof message - 1 && message[len - 1] == '\n')
                message[len - 1] = 0;
 
        real_logger(level, priority, message);
 }
 
 static void sptps_logger(sptps_t *s, int s_errno, const char *format, va_list ap) {
-       char message[1024] = "";
+       char message[1024];
        size_t msglen = sizeof message;
 
        int len = vsnprintf(message, msglen, format, ap);
-       if(len > 0 && len < sizeof message) {
+       message[sizeof message - 1] = 0;
+       if(len > 0 && len < sizeof message - 1) {
                if(message[len - 1] == '\n')
                        message[--len] = 0;
 

diff --git a/src/protocol.c b/src/protocol.c
index f533a93..b9abccc 100644 (file)
--- a/src/protocol.c
+++ b/src/protocol.c
@@ -72,10 +72,11 @@ bool send_request(connection_t *c, const char *format, ...) {
           input buffer anyway */
 
        va_start(args, format);
-       len = vsnprintf(request, MAXBUFSIZE, format, args);
+       len = vsnprintf(request, sizeof request, format, args);
+       request[sizeof request - 1] = 0;
        va_end(args);
 
-       if(len < 0 || len > MAXBUFSIZE - 1) {
+       if(len < 0 || len > sizeof request - 1) {
                logger(DEBUG_ALWAYS, LOG_ERR, "Output buffer overflow while sending request to %s (%s)",
                           c->name, c->hostname);
                return false;

diff --git a/src/tincctl.c b/src/tincctl.c
index 9f9df6f..a0a7633 100644 (file)
--- a/src/tincctl.c
+++ b/src/tincctl.c
@@ -560,6 +560,7 @@ bool sendline(int fd, char *format, ...) {
 
        va_start(ap, format);
        blen = vsnprintf(buffer, sizeof buffer, format, ap);
+       buffer[sizeof buffer - 1] = 0;
        va_end(ap);
 
        if(blen < 1 || blen >= sizeof buffer)
@@ -885,7 +886,7 @@ static int cmd_start(int argc, char *argv[]) {
 
        if(!pid) {
                close(pfd[0]);
-               char buf[100] = "";
+               char buf[100];
                snprintf(buf, sizeof buf, "%d", pfd[1]);
                setenv("TINC_UMBILICAL", buf, true);
                exit(execvp(c, nargv));