NUL terminate after copy

6 files changed, 42 insertions, 3 deletions

diff --git a/src/lib/delivery/delivery.c b/src/lib/delivery/delivery.c
index a97cc11..d4fe08c 100644
--- a/src/lib/delivery/delivery.c
+++ b/src/lib/delivery/delivery.c
@@ -367,6 +367,8 @@ void delivery_defer_packages(struct Delivery *ctx, int type) {
         SYSERROR("BUG: type %d does not map to a supported package manager!\n", type);
         exit(1);
     }
+    mode[sizeof(mode) - 1] = '\0';
+
     msg(STASIS_MSG_L2, "Filtering %s packages by test definition...\n", mode);
 
     struct StrList *filtered = NULL;
@@ -391,8 +393,10 @@ void delivery_defer_packages(struct Delivery *ctx, int type) {
                 spec_end++;
             }
             strncpy(package_name, name, spec_begin - name);
+            package_name[spec_begin - name] = '\0';
         } else {
             strncpy(package_name, name, sizeof(package_name) - 1);
+            package_name[sizeof(package_name) - 1] = '\0';
         }
         remove_extras(package_name);
 
@@ -404,6 +408,8 @@ void delivery_defer_packages(struct Delivery *ctx, int type) {
             char nametmp[STASIS_NAME_MAX] = {0};
 
             strncpy(nametmp, package_name, sizeof(nametmp) - 1);
+            nametmp[sizeof(nametmp) - 1] = '\0';
+
             // Is the [test:NAME] in the package name?
             if (!strcmp(nametmp, test->name)) {
                 // Override test->version when a version is provided by the (pip|conda)_package list item
diff --git a/src/lib/delivery/delivery_build.c b/src/lib/delivery/delivery_build.c
index 3ff5df7..49d2f5b 100644
--- a/src/lib/delivery/delivery_build.c
+++ b/src/lib/delivery/delivery_build.c
@@ -34,10 +34,11 @@ int delivery_build_recipes(struct Delivery *ctx) {
                         tag[len] = '\0';
                     } else {
                         strncpy(tag, ctx->tests->test[i]->repository_info_tag, sizeof(tag) - 1);
-                        tag[strlen(ctx->tests->test[i]->repository_info_tag)] = '\0';
+                        tag[sizeof(tag) - 1] = '\0';
                     }
                 } else {
                     strncpy(tag, ctx->tests->test[i]->version, sizeof(tag) - 1);
+                    tag[sizeof(tag) - 1] = '\0';
                 }
 
                 //sprintf(recipe_version, "{%% set version = GIT_DESCRIBE_TAG ~ \".dev\" ~ GIT_DESCRIBE_NUMBER ~ \"+\" ~ GIT_DESCRIBE_HASH %%}");
@@ -51,6 +52,7 @@ int delivery_build_recipes(struct Delivery *ctx) {
                 snprintf(recipe_version, sizeof(recipe_version), "{%% set version = \"%s\" %%}", tag);
                 snprintf(recipe_git_url, sizeof(recipe_git_url), "  url: %s/archive/refs/tags/{{ version }}.tar.gz", ctx->tests->test[i]->repository);
                 strncpy(recipe_git_rev, "", sizeof(recipe_git_rev) - 1);
+                recipe_git_rev[sizeof(recipe_git_rev) - 1] = '\0';
                 snprintf(recipe_buildno, sizeof(recipe_buildno), "  number: 0");
 
                 unsigned flags = REPLACE_TRUNCATE_AFTER_MATCH;
@@ -79,14 +81,17 @@ int delivery_build_recipes(struct Delivery *ctx) {
                         memset(platform, 0, sizeof(platform));
                         strncpy(platform, "osx", sizeof(platform) - 1);
                     }
+                    platform[sizeof(platform) - 1] = '\0';
                     tolower_s(platform);
+
                     if (strstr(ctx->system.arch, "arm64")) {
                         strncpy(arch, "arm64", sizeof(arch) - 1);
                     } else if (strstr(ctx->system.arch, "64")) {
                         strncpy(arch, "64", sizeof(arch) - 1);
                     } else {
-                        strncat(arch, "32", sizeof(arch) - 1); // blind guess
+                        strncat(arch, "32", sizeof(arch) - strlen(arch) - 1); // blind guess
                     }
+                    arch[sizeof(arch) - 1] = '\0';
                     tolower_s(arch);
 
                     snprintf(command, sizeof(command), "mambabuild --python=%s -m ../.ci_support/%s_%s_.yaml .",
@@ -385,6 +390,7 @@ struct StrList *delivery_build_wheels(struct Delivery *ctx) {
         char name[100] = {0};
         char *fullspec = strlist_item(ctx->conda.pip_packages_defer, p);
         strncpy(name, fullspec, sizeof(name) - 1);
+        name[sizeof(name) - 1] = '\0';
         remove_extras(name);
         char *spec = find_version_spec(name);
         if (spec) {
@@ -435,6 +441,7 @@ struct StrList *delivery_build_wheels(struct Delivery *ctx) {
                     }
 
                     strncpy(dname, ctx->tests->test[i]->name, sizeof(dname) - 1);
+                    dname[sizeof(dname) - 1] = '\0';
                     tolower_s(dname);
                     snprintf(outdir, sizeof(outdir), "%s/%s", ctx->storage.wheel_artifact_dir, dname);
                     if (mkdirs(outdir, 0755)) {
diff --git a/src/lib/delivery/delivery_docker.c b/src/lib/delivery/delivery_docker.c
index 1178a8c..3177c96 100644
--- a/src/lib/delivery/delivery_docker.c
+++ b/src/lib/delivery/delivery_docker.c
@@ -45,6 +45,7 @@ int delivery_docker(struct Delivery *ctx) {
     for (size_t i = 0; i < total_tags; i++) {
         char *tag_orig = strlist_item(ctx->deploy.docker.tags, i);
         strncpy(tag, tag_orig, sizeof(tag) - 1);
+        tag[sizeof(tag) - 1] = '\0';
         docker_sanitize_tag(tag);
         snprintf(args + strlen(args), sizeof(args) - strlen(args), " -t \"%s\" ", tag);
     }
@@ -103,6 +104,7 @@ int delivery_docker(struct Delivery *ctx) {
     // All tags point back to the same image so test the first one we see
     // regardless of how many are defined
     strncpy(tag, strlist_item(ctx->deploy.docker.tags, 0), sizeof(tag) - 1);
+    tag[sizeof(tag) - 1] = '\0';
     docker_sanitize_tag(tag);
 
     msg(STASIS_MSG_L2, "Executing image test script for %s\n", tag);
diff --git a/src/lib/delivery/delivery_init.c b/src/lib/delivery/delivery_init.c
index ff877f0..a163f01 100644
--- a/src/lib/delivery/delivery_init.c
+++ b/src/lib/delivery/delivery_init.c
@@ -178,22 +178,30 @@ int delivery_init_platform(struct Delivery *ctx) {
     } else {
         strncpy(archsuffix, ctx->system.arch, sizeof(archsuffix) - 1);
     }
+    archsuffix[sizeof(archsuffix) - 1] = '\0';
 
     SYSDEBUG("%s", "Setting platform");
     strncpy(ctx->system.platform[DELIVERY_PLATFORM], uts.sysname, DELIVERY_PLATFORM_MAXLEN - 1);
     if (!strcmp(ctx->system.platform[DELIVERY_PLATFORM], "Darwin")) {
         snprintf(ctx->system.platform[DELIVERY_PLATFORM_CONDA_SUBDIR], DELIVERY_PLATFORM_MAXLEN, "osx-%s", archsuffix);
         strncpy(ctx->system.platform[DELIVERY_PLATFORM_CONDA_INSTALLER], "MacOSX", DELIVERY_PLATFORM_MAXLEN - 1);
+        ctx->system.platform[DELIVERY_PLATFORM_CONDA_INSTALLER][DELIVERY_PLATFORM_MAXLEN - 1] = '\0';
         strncpy(ctx->system.platform[DELIVERY_PLATFORM_RELEASE], "macos", DELIVERY_PLATFORM_MAXLEN - 1);
+        ctx->system.platform[DELIVERY_PLATFORM_RELEASE][DELIVERY_PLATFORM_MAXLEN - 1] = '\0';
     } else if (!strcmp(ctx->system.platform[DELIVERY_PLATFORM], "Linux")) {
         snprintf(ctx->system.platform[DELIVERY_PLATFORM_CONDA_SUBDIR], DELIVERY_PLATFORM_MAXLEN, "linux-%s", archsuffix);
         strncpy(ctx->system.platform[DELIVERY_PLATFORM_CONDA_INSTALLER], "Linux", DELIVERY_PLATFORM_MAXLEN - 1);
+        ctx->system.platform[DELIVERY_PLATFORM_CONDA_INSTALLER][DELIVERY_PLATFORM_MAXLEN - 1] = '\0';
         strncpy(ctx->system.platform[DELIVERY_PLATFORM_RELEASE], "linux", DELIVERY_PLATFORM_MAXLEN - 1);
+        ctx->system.platform[DELIVERY_PLATFORM_RELEASE][DELIVERY_PLATFORM_MAXLEN - 1] = '\0';
     } else {
         // Not explicitly supported systems
         strncpy(ctx->system.platform[DELIVERY_PLATFORM_CONDA_SUBDIR], ctx->system.platform[DELIVERY_PLATFORM], DELIVERY_PLATFORM_MAXLEN - 1);
+        ctx->system.platform[DELIVERY_PLATFORM_CONDA_SUBDIR][DELIVERY_PLATFORM_MAXLEN - 1] = '\0';
         strncpy(ctx->system.platform[DELIVERY_PLATFORM_CONDA_INSTALLER], ctx->system.platform[DELIVERY_PLATFORM], DELIVERY_PLATFORM_MAXLEN - 1);
+        ctx->system.platform[DELIVERY_PLATFORM_CONDA_INSTALLER][DELIVERY_PLATFORM_MAXLEN - 1] = '\0';
         strncpy(ctx->system.platform[DELIVERY_PLATFORM_RELEASE], ctx->system.platform[DELIVERY_PLATFORM], DELIVERY_PLATFORM_MAXLEN - 1);
+        ctx->system.platform[DELIVERY_PLATFORM_RELEASE][DELIVERY_PLATFORM_MAXLEN - 1] = '\0';
         tolower_s(ctx->system.platform[DELIVERY_PLATFORM_RELEASE]);
     }
 
diff --git a/src/lib/delivery/delivery_install.c b/src/lib/delivery/delivery_install.c
index 22b3752..3d54eaa 100644
--- a/src/lib/delivery/delivery_install.c
+++ b/src/lib/delivery/delivery_install.c
@@ -32,8 +32,10 @@ static char *have_spec_in_config(const struct Delivery *ctx, const char *name) {
         char package[255] = {0};
         if (op) {
             strncpy(package, config_spec, op - config_spec);
+            package[op - config_spec] = '\0';
         } else {
             strncpy(package, config_spec, sizeof(package) - 1);
+            package[sizeof(package) - 1] = '\0';
         }
         remove_extras(package);
         if (strncmp(package, name, strlen(name)) == 0) {
@@ -81,8 +83,10 @@ int delivery_overlay_packages_from_env(struct Delivery *ctx, const char *env_nam
         char *op = find_version_spec(spec);
         if (op) {
             strncpy(spec_name, spec, op - spec);
+            spec_name[op - spec] = '\0';
         } else {
             strncpy(spec_name, spec, sizeof(spec_name) - 1);
+            spec_name[sizeof(spec_name) - 1] = '\0';
         }
 
         struct Test *test_block = requirement_from_test(ctx, spec_name);
@@ -102,8 +106,10 @@ int delivery_overlay_packages_from_env(struct Delivery *ctx, const char *env_nam
         // we only care about packages with specs here. if something else arrives, ignore it
         if (op) {
             strncpy(frozen_name, frozen_spec, op - frozen_spec);
+            frozen_name[op - frozen_spec] = '\0';
         } else {
             strncpy(frozen_name, frozen_spec, sizeof(frozen_name) - 1);
+            frozen_name[sizeof(frozen_name) - 1] = '\0';
         }
         struct Test *test = requirement_from_test(ctx, frozen_name);
         if (test && strcmp(test->name, frozen_name) == 0) {
@@ -151,15 +157,19 @@ int delivery_purge_packages(struct Delivery *ctx, const char *env_name, int use_
             fn = conda_exec;
             list = ctx->conda.conda_packages_purge;
             strncpy(package_manager, "conda", sizeof(package_manager) - 1);
+            package_manager[sizeof(package_manager) - 1] = '\0';
             // conda is already configured for "always_yes"
             strncpy(subcommand, "remove", sizeof(subcommand) - 1);
+            subcommand[sizeof(subcommand) - 1] = '\0';
             break;
         case PKG_USE_PIP:
             fn = pip_exec;
             list = ctx->conda.pip_packages_purge;
             strncpy(package_manager, "pip", sizeof(package_manager) - 1);
+            package_manager[sizeof(package_manager) - 1] = '\0';
             // avoid user prompt to remove packages
             strncpy(subcommand, "uninstall -y", sizeof(subcommand) - 1);
+            subcommand[sizeof(subcommand) - 1] = '\0';
             break;
         default:
             SYSERROR("Unknown package manager: %d", use_pkg_manager);
@@ -300,8 +310,10 @@ int delivery_install_packages(struct Delivery *ctx, char *conda_install_dir, cha
                     char req[255] = {0};
                     if (!strcmp(name, info->name)) {
                         strncpy(req, info->name, sizeof(req) - 1);
+                        req[sizeof(req) - 1] = '\0';
                     } else {
                         strncpy(req, name, sizeof(req) - 1);
+                        req[sizeof(req) - 1] = '\0';
                         char *spec = find_version_spec(req);
                         if (spec) {
                             *spec = 0;
diff --git a/src/lib/delivery/delivery_test.c b/src/lib/delivery/delivery_test.c
index a088cd7..5d5a3e8 100644
--- a/src/lib/delivery/delivery_test.c
+++ b/src/lib/delivery/delivery_test.c
@@ -201,6 +201,7 @@ void delivery_tests_run(struct Delivery *ctx) {
                 memset(&proc, 0, sizeof(proc));
 
                 strncpy(cmd, test->script, strlen(test->script) + STASIS_BUFSIZ - 1);
+                cmd[strlen(test->script) + STASIS_BUFSIZ - 1] = '\0';
                 char *cmd_rendered = tpl_render(cmd);
                 if (cmd_rendered) {
                     if (strcmp(cmd_rendered, cmd) != 0) {
@@ -230,6 +231,7 @@ void delivery_tests_run(struct Delivery *ctx) {
                     selected = SERIAL;
                     memset(pool_name, 0, sizeof(pool_name));
                     strncpy(pool_name, "serial", sizeof(pool_name) - 1);
+                    pool_name[sizeof(pool_name) - 1] = '\0';
                 }
 
                 if (asprintf(&runner_cmd, runner_cmd_fmt, cmd) < 0) {
@@ -281,11 +283,13 @@ void delivery_tests_run(struct Delivery *ctx) {
                     }
 
                     strncpy(cmd, test->script_setup, cmd_len - 1);
+                    cmd[cmd_len - 1] = '\0';
+
                     char *cmd_rendered = tpl_render(cmd);
                     if (cmd_rendered) {
                         if (strcmp(cmd_rendered, cmd) != 0) {
                             strncpy(cmd, cmd_rendered, cmd_len - 1);
-                            cmd[strlen(cmd_rendered) ? strlen(cmd_rendered) - 1 : 0] = 0;
+                            cmd[strlen(cmd_rendered) ? strlen(cmd_rendered) - 1 : 0] = '\0';
                         }
                         guard_free(cmd_rendered);
                     } else {