574 Minor issues in usr/src/cmd/format/startup.c

@@ -17,10 +17,12 @@
  * information: Portions Copyright [yyyy] [name of copyright owner]
  *
  * CDDL HEADER END
  */
 /*
+ * Copyright (c) 2012 Nexenta System Inc.
+ *
  * Copyright (c) 2011 Gary Mills
  *
  * Copyright (c) 1993, 2010, Oracle and/or its affiliates. All rights reserved.
  */
 

@@ -2960,32 +2962,27 @@
 /*
  * This Function checks if the non-conventional name is a a link to
  * one of the conventional whole disk name.
  */
 static int
-name_represents_wholedisk(name)
-char    *name;
+name_represents_wholedisk(char  *name)
 {
         char    symname[MAXPATHLEN];
         char    localname[MAXPATHLEN];
         char    *nameptr;
+        ssize_t symname_size;
+        size_t disk_prefix_len = strlen(DISK_PREFIX);
 
+        if (strlcpy(localname, name, MAXPATHLEN) >= MAXPATHLEN)
+                return (1);     /* buffer overflow, reject this name */
 
-        (void) memset(symname, 0, MAXPATHLEN);
-        (void) memset(localname, 0, MAXPATHLEN);
-        (void) strcpy(localname, name);
-
-        while (readlink(localname, symname, MAXPATHLEN) != -1) {
+        while ((symname_size = readlink(localname, symname, MAXPATHLEN - 1)) != -1) {
+                symname[symname_size] = '\0';
                 nameptr = symname;
-                if (strncmp(symname, DISK_PREFIX, strlen(DISK_PREFIX)) == 0)
-                        nameptr += strlen(DISK_PREFIX);
-                if (conventional_name(nameptr)) {
-                        if (whole_disk_name(nameptr))
-                                return (0);
-                        else
-                                return (1);
-                }
+                if (strncmp(symname, DISK_PREFIX, disk_prefix_len) == 0)
+                        nameptr += disk_prefix_len;
+                if (conventional_name(nameptr))
+                        return (!whole_disk_name(nameptr));
                 (void) strcpy(localname, symname);
-                (void) memset(symname, 0, MAXPATHLEN);
         }
         return (0);
 }