summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorPablo Barciela <[email protected]>2019-03-17 02:24:41 +0100
committerZenWalker <[email protected]>2019-03-17 16:13:55 +0100
commit8eedb8b7fa80c1e6cbf67c0d9543c8e5dcb6684f (patch)
tree1482d1d4a98feeb1e0ea7acafd6ec4138182b034
parente1581c669f31e1a43155d2ac5fe0926568629eaf (diff)
downloadmate-desktop-8eedb8b7fa80c1e6cbf67c0d9543c8e5dcb6684f.tar.bz2
mate-desktop-8eedb8b7fa80c1e6cbf67c0d9543c8e5dcb6684f.tar.xz
[Security] Use 'g_strlcpy' instead of 'strcpy'
Fixes Clang static analyzer warnings: mate-rr-config.c:549:3: warning: Call to function 'strcpy' is insecure as it does not provide bounding of the memory buffer. Replace unbounded copy functions with analogous functions that support length arguments such as 'strlcpy'. CWE-119 strcpy (output->priv->vendor, "???"); ^~~~~~ mate-desktop-item.c:2118:2: warning: Call to function 'strcpy' is insecure as it does not provide bounding of the memory buffer. Replace unbounded copy functions with analogous functions that support length arguments such as 'strlcpy'. CWE-119 strcpy (the_exec, exec); ^~~~~~
-rw-r--r--libmate-desktop/mate-desktop-item.c2
-rw-r--r--libmate-desktop/mate-rr-config.c2
2 files changed, 2 insertions, 2 deletions
diff --git a/libmate-desktop/mate-desktop-item.c b/libmate-desktop/mate-desktop-item.c
index 7b96385..f7b1154 100644
--- a/libmate-desktop/mate-desktop-item.c
+++ b/libmate-desktop/mate-desktop-item.c
@@ -2115,7 +2115,7 @@ mate_desktop_item_launch_on_screen_with_env (
/* make a new copy and get rid of spaces */
the_exec = g_alloca (strlen (exec) + 1);
- strcpy (the_exec, exec);
+ g_strlcpy (the_exec, exec, strlen (exec) + 1);
if ( ! strip_the_amp (the_exec)) {
g_set_error (error,
diff --git a/libmate-desktop/mate-rr-config.c b/libmate-desktop/mate-rr-config.c
index 6048db0..09d2b8f 100644
--- a/libmate-desktop/mate-rr-config.c
+++ b/libmate-desktop/mate-rr-config.c
@@ -546,7 +546,7 @@ mate_rr_config_load_current (MateRRConfig *config, GError **error)
}
else
{
- strcpy (output->priv->vendor, "???");
+ g_strlcpy (output->priv->vendor, "???", sizeof (output->priv->vendor));
output->priv->product = 0;
output->priv->serial = 0;
}