145370 - Replace strcpy by strncpy for charset name copy.

Status: VERIFIED FIXED

(MailNews Core :: Internationalization, defect)

Description

[nhottanscp]

http://lxr.mozilla.org/seamonkey/source/mailnews/mime/src/comi18n.cpp#1076
http://lxr.mozilla.org/seamonkey/source/mailnews/mime/src/comi18n.cpp#310
http://lxr.mozilla.org/seamonkey/source/mailnews/compose/src/nsMsgCompUtils.cpp#779
http://lxr.mozilla.org/seamonkey/source/mailnews/compose/src/nsMsgSendPart.cpp#66

Comment 1

[Mitchell Stoltz (not reading bugmail)]

This is great - please make this change. It's best to use sizeof() for the size
argument to PL_strcpy. For example,

PL_strncpy(charset_label, charset, sizeof(charset_label) - 1);
charset_label[sizeof(charset_label) - 1)] = '\0';

Add the explicit null termination as above.

Comment 2

[nhottanscp]

Attachment: Changed strcpy to strncpy.

Comment 3

[nhottanscp]

Mitch, could you review the patch?

Comment 4

[Jean-Francois Ducarroz]

Comment on attachment 84312 [details] [diff] [review]
Changed strcpy to strncpy.

R=ducarroz

Comment 5

[David :Bienvenu]

Comment on attachment 84312 [details] [diff] [review]
Changed strcpy to strncpy.

sr=bienvenu

Comment 6

[nhottanscp]

nsbeta1, the calls I changed were used for message compose/send, so far I have
not found actual problem but I think it's better to fix this to prevent unknown
problems.

Comment 7

[Frank Tang]

security issue. not sure this is adt2 or adt3. Put adt2 here for now. adt:
please change it if you disagree with that. thanks.

Comment 8

[nhottanscp]

checked in to the trunk

Comment 9

[nhottanscp]

nsMsgSendPart.cpp 1.52
nsMsgCompUtils.cpp 1.138
comi18n.cpp 1.109

verified by cvs

Comment 10

[scottputterman]

adding adt1.0.1+.  Please get drivers approval before checking into the branch.

Comment 11

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Comment on attachment 84312 [details] [diff] [review]
Changed strcpy to strncpy.

Please land this on the 1.0.1 branch.  Once there, remove the
"mozilla1.0.1+" keyword, and add the "fixed1.0.1"


(Perhaps, *on the trunk*, it might make sense to fix this using PL_strncpyz
instead, which will allow sizeof(buffer) and allow removing the extra
null-termination code.)