Re: [Qemu-devel] [PATCH] Security house-cleaning

[Tim]

> nooooope, strcpy has no way of knowing how big the buffer is other than
> what you tell it. It's likely that all (or most) of the buffers that are
> strcpy'd to are initialised to zero / .bss so it doesn't matter in
> reality, but better safe than sorry. What if some buffer is moved to
> stack later, that would expose the latent bug.

Oh... you are right.  It only pads with nulls if the src string is
shorter than the length argument.  I'll fix those and submit a new
version in a day or two.

thanks,
tim