Use xasprintf to build user key file names in ssh-vulnkey, avoiding

truncation problems (thanks, Solar Designer).

2 files changed, 9 insertions, 4 deletions

diff --git a/debian/changelog b/debian/changelog
index 6dafdad96..6023c99df 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -52,6 +52,8 @@ openssh (1:4.7p1-11) UNRELEASED; urgency=low
   * Allow building with heimdal-dev (LP: #125805).
   * Fix some buffer handling inconsistencies in ssh-vulnkey (thanks, Solar
     Designer).
+  * Use xasprintf to build user key file names in ssh-vulnkey, avoiding
+    truncation problems (thanks, Solar Designer).
 
  -- Colin Watson <cjwatson@debian.org>  Sat, 17 May 2008 08:48:45 +0200
 
diff --git a/ssh-vulnkey.c b/ssh-vulnkey.c
index 467bef091..8e1f11f79 100644
--- a/ssh-vulnkey.c
+++ b/ssh-vulnkey.c
@@ -266,16 +266,19 @@ int
 do_user(const char *dir)
 {
         int i;
-        char buf[MAXPATHLEN];
+        char *file;
         struct stat st;
         int ret = 1;
 
         for (i = 0; default_files[i]; i++) {
-                snprintf(buf, sizeof(buf), "%s/%s", dir, default_files[i]);
-                if (stat(buf, &st) < 0 && errno == ENOENT)
+                xasprintf(&file, "%s/%s", dir, default_files[i]);
+                if (stat(file, &st) < 0 && errno == ENOENT) {
+                        xfree(file);
                         continue;
-                if (!do_filename(buf, 0))
+                }
+                if (!do_filename(file, 0))
                         ret = 0;
+                xfree(file);
         }
 
         return ret;