*** 503,513 ****
          event->ine_event.mask = (uint32_t)mask;
          event->ine_event.cookie = cookie;
          event->ine_event.len = len;
  
          if (name != NULL)
!                 strcpy(event->ine_event.name, name);
  
          if (tail != NULL) {
                  tail->ine_next = event;
          } else {
                  VERIFY(state->ins_head == NULL);
--- 503,513 ----
          event->ine_event.mask = (uint32_t)mask;
          event->ine_event.cookie = cookie;
          event->ine_event.len = len;
  
          if (name != NULL)
!                 (void) strcpy(event->ine_event.name, name);
  
          if (tail != NULL) {
                  tail->ine_next = event;
          } else {
                  VERIFY(state->ins_head == NULL);
*** 627,637 ****
                  VERIFY(name != NULL);
                  inotify_watch_hold(parent);
                  watch->inw_mask &= IN_CHILD_EVENTS;
                  watch->inw_parent = parent;
                  watch->inw_name = kmem_alloc(strlen(name) + 1, KM_SLEEP);
!                 strcpy(watch->inw_name, name);
  
                  avl_add(&parent->inw_children, watch);
          }
  
          /*
--- 627,638 ----
                  VERIFY(name != NULL);
                  inotify_watch_hold(parent);
                  watch->inw_mask &= IN_CHILD_EVENTS;
                  watch->inw_parent = parent;
                  watch->inw_name = kmem_alloc(strlen(name) + 1, KM_SLEEP);
!                 /* strcpy() is safe, because strlen(name) bounds us. */
!                 (void) strcpy(watch->inw_name, name);
  
                  avl_add(&parent->inw_children, watch);
          }
  
          /*