Ensure that strings are null terminated after strncpy().

From the strcpy(3) man page, the following warning is given:
  The strncpy() function is similar, except that at most n bytes of src
  are  copied.  Warning: If there is no null byte among the first n bytes
  of src, the string placed in dest will not be null-terminated.

The current corosync code base does not take this warning into account
when using strncpy, potentially resulting in non-null terminated strings.

Signed-off-by: Russell Bryant <russell@russellbryant.net>
Reviewed-by: Steven Dake <sdake@redhat.com>
(backported from commit a609f79f1f8d23f8e57fe2afb383bd62621545f6)

exec/logsys.c

@@ -922,7 +922,9 @@ static void logsys_subsys_init (
 			LOGSYS_LOGGER_INIT_DONE;
 	}
 	strncpy (logsys_loggers[subsysid].subsys, subsys,
-		LOGSYS_MAX_SUBSYS_NAMELEN);
+		sizeof (logsys_loggers[subsysid].subsys));
+	logsys_loggers[subsysid].subsys[
+		sizeof (logsys_loggers[subsysid].subsys) - 1] = '\0';
 }
 
 /*
@@ -978,7 +980,8 @@ int _logsys_system_setup(
 			(logsys_loggers[i].init_status ==
 			 LOGSYS_LOGGER_NEEDS_INIT)) {
 				strncpy (tempsubsys, logsys_loggers[i].subsys,
-					LOGSYS_MAX_SUBSYS_NAMELEN);
+					sizeof (tempsubsys));
+				tempsubsys[sizeof (tempsubsys) - 1] = '\0';
 				logsys_subsys_init(tempsubsys, i);
 		}
 	}

exec/util.c

@@ -117,7 +117,8 @@ char *getcs_name_t (cs_name_t *name)
 }
 
 void setcs_name_t (cs_name_t *name, char *str) {
-	strncpy ((char *)name->value, str, CS_MAX_NAME_LENGTH);
+	strncpy ((char *)name->value, str, sizeof (name->value));
+	((char *)name->value)[sizeof (name->value) - 1] = '\0';
 	if (strlen ((char *)name->value) > CS_MAX_NAME_LENGTH) {
 		name->length = CS_MAX_NAME_LENGTH;
 	} else {

test/sa_error.c

@@ -46,6 +46,9 @@ int get_sa_error(cs_error_t error, char *str, int len)
 		return -1;
 	}
 	strncpy(str, sa_error_list[error], len);
+	if (len > 0) {
+		str[len - 1] = '\0';
+	}
 	return 0;
 }
 

tools/corosync-objctl.c

@@ -406,7 +406,8 @@ static cs_error_t find_object (confdb_handle_t handle,
 	char tmp_name[OBJ_NAME_SIZE];
 	cs_error_t res = CS_OK;
 
-	strncpy (tmp_name, name_pt, OBJ_NAME_SIZE);
+	strncpy (tmp_name, name_pt, sizeof (tmp_name));
+	tmp_name[sizeof (tmp_name) - 1] = '\0';
 	obj_name_pt = strtok_r(tmp_name, SEPERATOR_STR, &save_pt);
 
 	while (obj_name_pt != NULL) {
@@ -516,7 +517,8 @@ static void create_object(confdb_handle_t handle, char * name_pt)
 	char tmp_name[OBJ_NAME_SIZE];
 	cs_error_t res;
 
-	strncpy (tmp_name, name_pt, OBJ_NAME_SIZE);
+	strncpy (tmp_name, name_pt, sizeof (tmp_name));
+	tmp_name[sizeof (tmp_name) - 1] = '\0';
 	obj_name_pt = strtok_r(tmp_name, SEPERATOR_STR, &save_pt);
 
 	while (obj_name_pt != NULL) {
@@ -569,7 +571,8 @@ static void create_object_key(confdb_handle_t handle, char *name_pt)
 	get_parent_name(name_pt, parent_name);
 	get_key(name_pt, key_name, key_value);
 
-	strncpy (tmp_name, parent_name, OBJ_NAME_SIZE);
+	strncpy (tmp_name, parent_name, sizeof (tmp_name));
+	tmp_name[sizeof (tmp_name) - 1] = '\0';
 	obj_name_pt = strtok_r(tmp_name, SEPERATOR_STR, &save_pt);
 
 	/*