These naked strcpy()s scare me

diff --git a/ext/ereg/ereg.c b/ext/ereg/ereg.c
index 3fbaa2cc63a5fb41c11ad138c9377e4cd36134c2..c2b065210a5614a11651cc5c8eb1f08c5f376e94 100644 (file)
--- a/ext/ereg/ereg.c
+++ b/ext/ereg/ereg.c
@@ -474,7 +474,7 @@ PHP_EREG_API char *php_ereg_replace(const char *pattern, const char *replace, co
                        if (new_l + 1 > buf_len) {
                                buf_len = 1 + buf_len + 2 * new_l;
                                nbuf = emalloc(buf_len);
-                               strcpy(nbuf, buf);
+                               strncpy(nbuf, buf, buf_len-1);
                                efree(buf);
                                buf = nbuf;
                        }
@@ -511,7 +511,7 @@ PHP_EREG_API char *php_ereg_replace(const char *pattern, const char *replace, co
                                if (new_l + 1 > buf_len) {
                                        buf_len = 1 + buf_len + 2 * new_l;
                                        nbuf = safe_emalloc(buf_len, sizeof(char), 0);
-                                       strcpy(nbuf, buf);
+                                       strncpy(nbuf, buf, buf_len-1);
                                        efree(buf);
                                        buf = nbuf;
                                }
@@ -526,7 +526,7 @@ PHP_EREG_API char *php_ereg_replace(const char *pattern, const char *replace, co
                        if (new_l + 1 > buf_len) {
                                buf_len = new_l + 1; /* now we know exactly how long it is */
                                nbuf = safe_emalloc(buf_len, sizeof(char), 0);
-                               strcpy(nbuf, buf);
+                               strncpy(nbuf, buf, buf_len-1);
                                efree(buf);
                                buf = nbuf;
                        }