Closes issue #11471. Replaced instances of strncpy with zap_copy_string (added to zaptel.h) to fix any off by one errors and ensure destination string is NULL terminated.

git-svn-id: http://svn.digium.com/svn/zaptel/branches/1.4@3846 5390a7c7-147a-4af0-8ec9-7488f05a26cb

1 files changed, 26 insertions, 0 deletions

diff --git a/kernel/zaptel.h b/kernel/zaptel.h
index 53bebf3..baffaa1 100644
--- a/kernel/zaptel.h
+++ b/kernel/zaptel.h
@@ -2006,4 +2006,30 @@ struct torisa_debug {
 /* Special torisa ioctl */
 #define TORISA_GETDEBUG		_IOW (ZT_CODE, 60, struct torisa_debug)
 
+/*!
+	\brief Size-limited null-terminating string copy.
+	\param dst The destination buffer
+	\param src The source string
+	\param size The size of the destination buffer
+	\return Nothing.
+
+	This is similar to \a strncpy, with two important differences:
+	- the destination buffer will \b always be null-terminated
+	- the destination buffer is not filled with zeros past the copied string length
+	These differences make it slightly more efficient, and safer to use since it will
+	not leave the destination buffer unterminated. There is no need to pass an artificially
+	reduced buffer size to this function (unlike \a strncpy), and the buffer does not need
+	to be initialized to zeroes prior to calling this function.
+*/
+static inline void zap_copy_string(char *dst, const char *src, unsigned int size)
+{
+	while (*src && size) {
+		*dst++ = *src++;
+		size--;
+	}
+	if (__builtin_expect(!size, 0))
+		dst--;
+	*dst = '\0';
+}
+
 #endif /* _LINUX_ZAPTEL_H */