slurpd -r buffer overflow (ITS#722)

[jhuuskon@messi.uku.fi]

Full_Name: Jarno Huuskonen
Version: 2.0.1
OS: Linux
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (193.167.224.11)


slurpd doesn't check -r command line parameter length before using strcpy -->
buffer overflow

Here's a quick patch:
--- args.c-orig Sun Sep 10 13:56:09 2000
+++ args.c      Sun Sep 10 13:58:03 2000
@@ -106,7 +106,8 @@
            g->slapd_configfile = strdup( optarg );
            break;
        case 'r':       /* slapd replog file */
-           strcpy( g->slapd_replogfile, optarg );
+               strncpy( g->slapd_replogfile, optarg, MAXPATHLEN-1);
+               g->slapd_replogfile[MAXPATHLEN-1] = '\0';
            rflag++;
            break;
        case 't':       /* dir to use for our copies of replogs */