Force null terminator on filename, s/strcpy/strncpy/g.

1 files changed, 9 insertions, 3 deletions

diff --git a/src/extract.c b/src/extract.c
index 9c45941..515d2dd 100644
--- a/src/extract.c
+++ b/src/extract.c
@@ -24,6 +24,11 @@ void fix_filename(void) {
 
 	if(!out_filename) return;
 
+	if(strlen(out_filename) > 12) {
+		fprintf(stderr, "%s: filename in ALF header not null-terminated, fixing.\n", self);
+		out_filename[12] = '\0';
+	}
+
 	if(opts.lowercase) {
 		for(p = out_filename; *p; p++)
 			*p = tolower(*p);
@@ -37,10 +42,11 @@ void fix_filename(void) {
 }
 
 void make_backup(void) {
-	char backup[PATH_MAX];
+	/* up to 12-char FILENAME.EXT, plus a ~, plus null terminator = 14 */
+	char backup[14];
 
-	strcpy(backup, out_filename);
-	strcat(backup, "~");
+	strncpy(backup, out_filename, 13);
+	strncat(backup, "~", 13);
 
 	/* silently ignore errors! */
 	rename(out_filename, backup);