(svn r14414) -Fix: replace instances of strncpy with strecpy as strncpy doesn't guarantee the resulting string is '\0'-terminated.

10 files changed, 14 insertions, 11 deletions

diff --git a/src/console.cpp b/src/console.cpp
index a9f2d20c3..48bb2f941 100644
--- a/src/console.cpp
+++ b/src/console.cpp
@@ -389,7 +389,7 @@ IConsoleAlias *IConsoleAliasGet(const char *name)
 static inline int IConsoleCopyInParams(char *dst, const char *src, uint bufpos)
 {
 	int len = min(ICON_MAX_STREAMSIZE - bufpos, (uint)strlen(src));
-	strncpy(dst, src, len);
+	strecpy(dst, src, dst + len - 1);
 
 	return len;
 }
diff --git a/src/fileio.cpp b/src/fileio.cpp
index 381d51c57..dc5e9065f 100644
--- a/src/fileio.cpp
+++ b/src/fileio.cpp
@@ -633,7 +633,7 @@ static bool TarListAddFile(const char *filename)
 						} else {
 							/* Append at end of 'dest' */
 							if (destpos != dest) *(destpos++) = PATHSEPCHAR;
-							strncpy(destpos, pos, next - pos);
+							strncpy(destpos, pos, next - pos); // Safe as we do '\0'-termination ourselves
 							destpos += next - pos;
 						}
 						*destpos = '\0';
diff --git a/src/gamelog.cpp b/src/gamelog.cpp
index 029f43b70..b57f7a47a 100644
--- a/src/gamelog.cpp
+++ b/src/gamelog.cpp
@@ -394,7 +394,7 @@ void GamelogRevision()
 	LoggedChange *lc = GamelogChange(GLCT_REVISION);
 	if (lc == NULL) return;
 
-	strncpy(lc->revision.text, _openttd_revision, lengthof(lc->revision.text));
+	strecpy(lc->revision.text, _openttd_revision, lastof(lc->revision.text));
 	lc->revision.slver = SAVEGAME_VERSION;
 	lc->revision.modified = _openttd_revision_modified;
 	lc->revision.newgrf = _openttd_newgrf_version;
diff --git a/src/misc_gui.cpp b/src/misc_gui.cpp
index 91c03c2d2..028fd9409 100644
--- a/src/misc_gui.cpp
+++ b/src/misc_gui.cpp
@@ -633,6 +633,7 @@ struct TooltipsWindow : public Window
 	{
 		this->string_id = str;
 		assert(sizeof(this->params[0]) == sizeof(params[0]));
+		assert(paramcount <= lengthof(this->params));
 		memcpy(this->params, params, sizeof(this->params[0]) * paramcount);
 		this->paramcount = paramcount;
 		this->use_left_mouse_button = use_left_mouse_button;
diff --git a/src/music/win32_m.cpp b/src/music/win32_m.cpp
index ef2c826b3..c9fc6ece0 100644
--- a/src/music/win32_m.cpp
+++ b/src/music/win32_m.cpp
@@ -22,6 +22,7 @@ static FMusicDriver_Win32 iFMusicDriver_Win32;
 
 void MusicDriver_Win32::PlaySong(const char *filename)
 {
+	assert(filename != NULL);
 	strcpy(_midi.start_song, filename);
 	_midi.playing = true;
 	_midi.stop_song = false;
diff --git a/src/namegen.cpp b/src/namegen.cpp
index cd6cba2ea..d9fa7c97d 100644
--- a/src/namegen.cpp
+++ b/src/namegen.cpp
@@ -36,7 +36,7 @@ static inline int32 SeedChanceBias(int shift_by, int max, uint32 seed, int bias)
 
 static void ReplaceWords(const char *org, const char *rep, char *buf)
 {
-	if (strncmp(buf, org, 4) == 0) strncpy(buf, rep, 4);
+	if (strncmp(buf, org, 4) == 0) strncpy(buf, rep, 4); // Safe as the string in buf is always more than 4 characters long.
 }
 
 static byte MakeEnglishOriginalTownName(char *buf, uint32 seed, const char *last)
diff --git a/src/network/core/host.cpp b/src/network/core/host.cpp
index 70e9f57c7..5308bce04 100644
--- a/src/network/core/host.cpp
+++ b/src/network/core/host.cpp
@@ -162,7 +162,7 @@ static int NetworkFindBroadcastIPsInternal(uint32 *broadcast, int limit) // !GET
 		if (req->ifr_addr.sa_family == AF_INET) {
 			struct ifreq r;
 
-			strncpy(r.ifr_name, req->ifr_name, lengthof(r.ifr_name));
+			strecpy(r.ifr_name, req->ifr_name, lastof(r.ifr_name));
 			if (ioctl(sock, SIOCGIFFLAGS, &r) != -1 &&
 					r.ifr_flags & IFF_BROADCAST &&
 					ioctl(sock, SIOCGIFBRDADDR, &r) != -1) {
diff --git a/src/osk_gui.cpp b/src/osk_gui.cpp
index 9e1ee75b1..ad7577630 100644
--- a/src/osk_gui.cpp
+++ b/src/osk_gui.cpp
@@ -313,13 +313,13 @@ void GetKeyboardLayout()
 	if (StrEmpty(_keyboard_opt[0])) {
 		GetString(keyboard[0], STR_OSK_KEYBOARD_LAYOUT, lastof(keyboard[0]));
 	} else {
-		strncpy(keyboard[0], _keyboard_opt[0], lengthof(keyboard[0]));
+		strecpy(keyboard[0], _keyboard_opt[0], lastof(keyboard[0]));
 	}
 
 	if (StrEmpty(_keyboard_opt[1])) {
 		GetString(keyboard[1], STR_OSK_KEYBOARD_LAYOUT_CAPS, lastof(keyboard[1]));
 	} else {
-		strncpy(keyboard[1], _keyboard_opt[1], lengthof(keyboard[1]));
+		strecpy(keyboard[1], _keyboard_opt[1], lastof(keyboard[1]));
 	}
 
 	for (uint j = 0; j < 2; j++) {
diff --git a/src/video/dedicated_v.cpp b/src/video/dedicated_v.cpp
index 08fd87d28..6577bd6b7 100644
--- a/src/video/dedicated_v.cpp
+++ b/src/video/dedicated_v.cpp
@@ -226,7 +226,8 @@ static void DedicatedHandleKeyInput()
 	if (fgets(input_line, lengthof(input_line), stdin) == NULL) return;
 #else
 	/* Handle console input, and singal console thread, it can accept input again */
-	strncpy(input_line, _win_console_thread_buffer, lengthof(input_line));
+	assert_compile(lengthof(_win_console_thread_buffer) <= lengthof(input_line));
+	strcpy(input_line, _win_console_thread_buffer);
 	SetEvent(_hWaitForInputHandling);
 #endif
 
diff --git a/src/win32.cpp b/src/win32.cpp
index acdaab87d..4c33bfbd4 100644
--- a/src/win32.cpp
+++ b/src/win32.cpp
@@ -1046,14 +1046,14 @@ void DetermineBasePaths(const char *exe)
 	TCHAR path[MAX_PATH];
 #ifdef WITH_PERSONAL_DIR
 	SHGetFolderPath(NULL, CSIDL_PERSONAL, NULL, SHGFP_TYPE_CURRENT, path);
-	strncpy(tmp, WIDE_TO_MB_BUFFER(path, tmp, lengthof(tmp)), lengthof(tmp));
+	strecpy(tmp, WIDE_TO_MB_BUFFER(path, tmp, lengthof(tmp)), lastof(tmp));
 	AppendPathSeparator(tmp, MAX_PATH);
 	ttd_strlcat(tmp, PERSONAL_DIR, MAX_PATH);
 	AppendPathSeparator(tmp, MAX_PATH);
 	_searchpaths[SP_PERSONAL_DIR] = strdup(tmp);
 
 	SHGetFolderPath(NULL, CSIDL_COMMON_DOCUMENTS, NULL, SHGFP_TYPE_CURRENT, path);
-	strncpy(tmp, WIDE_TO_MB_BUFFER(path, tmp, lengthof(tmp)), lengthof(tmp));
+	strecpy(tmp, WIDE_TO_MB_BUFFER(path, tmp, lengthof(tmp)), lastof(tmp));
 	AppendPathSeparator(tmp, MAX_PATH);
 	ttd_strlcat(tmp, PERSONAL_DIR, MAX_PATH);
 	AppendPathSeparator(tmp, MAX_PATH);
@@ -1078,7 +1078,7 @@ void DetermineBasePaths(const char *exe)
 			DEBUG(misc, 0, "GetFullPathName failed (%d)\n", GetLastError());
 			_searchpaths[SP_BINARY_DIR] = NULL;
 		} else {
-			strncpy(tmp, WIDE_TO_MB_BUFFER(exec_dir, tmp, lengthof(tmp)), lengthof(tmp));
+			strecpy(tmp, WIDE_TO_MB_BUFFER(exec_dir, tmp, lengthof(tmp)), lastof(tmp));
 			char *s = strrchr(tmp, PATHSEPCHAR);
 			*(s + 1) = '\0';
 			_searchpaths[SP_BINARY_DIR] = strdup(tmp);