- (djm) [loginrec.c] Check for username truncation when looking up lastlog

   entries

1 files changed, 6 insertions, 4 deletions

diff --git a/loginrec.c b/loginrec.c
index 59e8a44e..8844db54 100644
--- a/loginrec.c
+++ b/loginrec.c
@@ -310,9 +310,12 @@ login_get_lastlog(struct logininfo *li, const uid_t uid)
 		fatal("%s: Cannot find account for uid %ld", __func__,
 		    (long)uid);
 
-	/* No MIN_SIZEOF here - we absolutely *must not* truncate the
-	 * username (XXX - so check for trunc!) */
-	strlcpy(li->username, pw->pw_name, sizeof(li->username));
+	if (strlcpy(li->username, pw->pw_name, sizeof(li->username)) >=
+	    sizeof(li->username)) {
+		error("%s: username too long (%lu > max %lu)", __func__,
+		    strlen(pw->pw_name), sizeof(li->username) - 1);
+		return NULL;
+	}
 
 	if (getlast_entry(li))
 		return (li);
@@ -320,7 +323,6 @@ login_get_lastlog(struct logininfo *li, const uid_t uid)
 		return (NULL);
 }
 
-
 /*
  * login_alloc_entry(int, char*, char*, char*)    - Allocate and initialise
  *                                                  a logininfo structure