sar and pidstat: Check that _("Average") string doesn't exceed

the size of the timestamp buffer.

One could find something like:
strcpy(string, _("Average"));
in pidstat.c and sar.c. Yet, we don't know whether the translation
message for "Average" will fit in target string buffer. Hence we
replaced the previous expression with something like:
strncpy(string, _("Average"), length_of_string_buffer);
string[lenght_of_string_buffer - 1] = '\0';

diff --git a/CHANGES b/CHANGES
index 864f1ca70f664d472b076bd4d3a16f481dec98a4..e2500d10cd42dab5cce90a0987f6fbc85c735d2e 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -6,6 +6,8 @@ xxxx/xx/xx: Version 10.0.1 - Sebastien Godard (sysstat <at> orange.fr)
        * sar: Decrease column width for sensor device name (temperature,
          voltage inputs and fans statistics).
        * Remove unnecessary arguments from functions in pr_stats.c.
+       * sar and pidstat: Check that _("Average") string doesn't exceed
+         the size of the timestamp buffer.
        * [Ivana Varekova]: Added option -h to iostat. This option makes
          the device utilization report easier to read with long device
          names.

diff --git a/pidstat.c b/pidstat.c
index 672c848a7c86c957250a20933fa5d24d4e9c0df7..02ce4d35303204b063047452d2e3bbd4d48af9c7 100644 (file)
--- a/pidstat.c
+++ b/pidstat.c
@@ -1816,7 +1816,8 @@ void write_stats_avg(int curr, int dis)
 {
        char string[16];
 
-       strcpy(string, _("Average:"));
+       strncpy(string, _("Average:"), 16);
+       string[15] = '\0';
        write_stats_core(2, curr, dis, TRUE, string, string);
 }
 

diff --git a/sar.c b/sar.c
index 75df408e480c676bab4c902b021ceb9b61b5fb55..07fca43acb82999e429f74afbe760e100ccf7844 100644 (file)
--- a/sar.c
+++ b/sar.c
@@ -378,7 +378,8 @@ void write_stats_avg(int curr, int read_from_file, unsigned int act_id)
        else
                itv = g_itv;
 
-       strcpy(timestamp[curr], _("Average:"));
+       strncpy(timestamp[curr], _("Average:"), TIMESTAMP_LEN);
+       timestamp[curr][TIMESTAMP_LEN - 1] = '\0';
        strcpy(timestamp[!curr], timestamp[curr]);
        
        /* Test stdout */