Give strlcat() full buffer lengths rather than smaller buffer lengths

strlcat() is supposed to be given the length of the destination buffer,
including the existing contents. Unfortunately, I had been overzealous
when I wrote a51288aabbbc176a8a73a8b3cd56f79607db32cf, since I gave it
the length of the destination buffer, minus the existing contents. This
likely caused a regression on large strings.

On the topic of being overzealous, the use of strlcat() in
dmu_send_estimate_fast() was unnecessary because recv_clone_name is a
fixed length string. We continue using strlcat() mostly as defensive
programming, in case the string length is ever changed, even though it
is unnecessary.

Reviewed-by: Ryan Moeller <ryan@iXsystems.com>
Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov>
Signed-off-by: Richard Yao <richard.yao@alumni.stonybrook.edu>
Closes #14476

diff --git a/lib/libshare/nfs.c b/lib/libshare/nfs.c
index 118ad7ef2209effb2ba0f15557990901b0c653c1..3962c87453d4a814935d032f891b5a2c76325ed7 100644 (file)
--- a/lib/libshare/nfs.c
+++ b/lib/libshare/nfs.c
@@ -97,7 +97,7 @@ nfs_init_tmpfile(const char *prefix, const char *mdir, struct tmpfile *tmpf)
        }
 
        strlcpy(tmpf->name, prefix, sizeof (tmpf->name));
-       strlcat(tmpf->name, ".XXXXXXXX", sizeof (tmpf->name) - strlen(prefix));
+       strlcat(tmpf->name, ".XXXXXXXX", sizeof (tmpf->name));
 
        int fd = mkostemp(tmpf->name, O_CLOEXEC);
        if (fd == -1) {

diff --git a/lib/libzfs/libzfs_sendrecv.c b/lib/libzfs/libzfs_sendrecv.c
index 1d2ad1944051f639c5f173cc93c9c4ef5029ba11..66a22e333663d3c5c1f5b7b87b061b2fd0eeb179 100644 (file)
--- a/lib/libzfs/libzfs_sendrecv.c
+++ b/lib/libzfs/libzfs_sendrecv.c
@@ -4590,7 +4590,7 @@ zfs_receive_one(libzfs_handle_t *hdl, int infd, const char *tosnap,
                            B_FALSE, destsnap) == 0) {
                                *strchr(destsnap, '@') = '\0';
                                (void) strlcat(destsnap, suffix,
-                                   sizeof (destsnap) - strlen(destsnap));
+                                   sizeof (destsnap));
                        }
                }
        } else {
@@ -4626,7 +4626,7 @@ zfs_receive_one(libzfs_handle_t *hdl, int infd, const char *tosnap,
                            B_FALSE, destsnap) == 0) {
                                *strchr(destsnap, '@') = '\0';
                                (void) strlcat(destsnap, snap,
-                                   sizeof (destsnap) - strlen(destsnap));
+                                   sizeof (destsnap));
                        }
                }
        }

diff --git a/module/zfs/dmu_send.c b/module/zfs/dmu_send.c
index 33beb04b19b1d06d19e98b8b58b32bb083cb2f10..f86a0a5b1c5780a8a2ece15bc0ff66d1c336b425 100644 (file)
--- a/module/zfs/dmu_send.c
+++ b/module/zfs/dmu_send.c
@@ -3029,8 +3029,7 @@ dmu_send_estimate_fast(dsl_dataset_t *origds, dsl_dataset_t *fromds,
 
                dsl_dataset_name(origds, dsname);
                (void) strcat(dsname, "/");
-               (void) strlcat(dsname, recv_clone_name,
-                   sizeof (dsname) - strlen(dsname));
+               (void) strlcat(dsname, recv_clone_name, sizeof (dsname));
 
                err = dsl_dataset_hold(origds->ds_dir->dd_pool,
                    dsname, FTAG, &ds);