Merged revisions 106552 via svnmerge from

https://origsvn.digium.com/svn/asterisk/branches/1.4

........
r106552 | tilghman | 2008-03-07 00:36:33 -0600 (Fri, 07 Mar 2008) | 6 lines

Safely use the strncat() function.
(closes issue #11958)
 Reported by: norman
 Patches: 
       20080209__bug11958.diff.txt uploaded by Corydon76 (license 14)

........


git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@106553 65c4cc65-6c06-0410-ace0-fbb531ad65f3

3 files changed, 10 insertions, 8 deletions

diff --git a/main/asterisk.c b/main/asterisk.c
index 21aee3b6e..37cc579cb 100644
--- a/main/asterisk.c
+++ b/main/asterisk.c
@@ -2061,10 +2061,12 @@ static char *cli_prompt(EditLine *el)
 		if (color_used) {
 			/* Force colors back to normal at end */
 			term_color_code(term_code, COLOR_WHITE, COLOR_BLACK, sizeof(term_code));
-			if (strlen(term_code) > sizeof(prompt) - strlen(prompt))
-				strncat(prompt + sizeof(prompt) - strlen(term_code) - 1, term_code, strlen(term_code));
-			else
+			if (strlen(term_code) > sizeof(prompt) - strlen(prompt) - 1) {
+				ast_copy_string(prompt + sizeof(prompt) - strlen(term_code) - 1, term_code, strlen(term_code) + 1);
+			} else {
+				/* This looks wrong, but we've already checked the length of term_code to ensure it's safe */
 				strncat(p, term_code, sizeof(term_code));
+			}
 		}
 	} else if (remotehostname)
 		snprintf(prompt, sizeof(prompt), ASTERISK_PROMPT2, remotehostname);
diff --git a/main/channel.c b/main/channel.c
index 3c68a71b7..20c2ee497 100644
--- a/main/channel.c
+++ b/main/channel.c
@@ -4774,12 +4774,12 @@ char *ast_print_group(char *buf, int buflen, ast_group_t group)
 	for (i = 0; i <= 63; i++) {	/* Max group is 63 */
 		if (group & ((ast_group_t) 1 << i)) {
 	   		if (!first) {
-				strncat(buf, ", ", buflen);
+				strncat(buf, ", ", buflen - strlen(buf) - 1);
 			} else {
 				first = 0;
 	  		}
 			snprintf(num, sizeof(num), "%u", i);
-			strncat(buf, num, buflen);
+			strncat(buf, num, buflen - strlen(buf) - 1);
 		}
 	}
 	return buf;
diff --git a/main/frame.c b/main/frame.c
index 940ff5c5c..f2ceabf16 100644
--- a/main/frame.c
+++ b/main/frame.c
@@ -992,16 +992,16 @@ int ast_codec_pref_string(struct ast_codec_pref *pref, char *buf, size_t size)
 			slen = strlen(formatname);
 			if (slen > total_len)
 				break;
-			strncat(buf,formatname,total_len);
+			strncat(buf, formatname, total_len - 1); /* safe */
 			total_len -= slen;
 		}
 		if (total_len && x < 31 && ast_codec_pref_index(pref , x + 1)) {
-			strncat(buf,"|",total_len);
+			strncat(buf, "|", total_len - 1); /* safe */
 			total_len--;
 		}
 	}
 	if (total_len) {
-		strncat(buf,")",total_len);
+		strncat(buf, ")", total_len - 1); /* safe */
 		total_len--;
 	}