Re: [Libcdio-devel] [Patch] More bullet-proof drive detection for GNU/Linux

[Burkhard Plaum]

Hi,

R. Bernstein wrote:
> I guess nothing based on /sys just yet.

No. It can be added later, but for older kernels (without /sys),
we need a fallback anyway. And since the current method should work
for *all* linuxes, I don't know if it's worth the effort to implement
something more advanced.

> Sorry for the late comment. I notice in cdio_follow_symlink() of
> lib/driver/util.c some strcpy's used. Isn't good security practice to
> use strncpy instead? Especially when one has the max length around
> (PATH_MAX, and/or len)?

The question is: Can we trust PATH_MAX? The destination arrays are
always PATH_MAX large, so an overflow occurs only if the src is larger than
PATH_MAX. But can this happen? If yes, than we should change strcpy to
strncpy, that's right. And then: Does PATH_MAX include the trailing '\0'?
If not, we should make the arrays one byte longer.

Burkhard