[PATCH v2 4/6] doc/migration: Use snprintf() for socket path and fix argv access

[Jon Maloy <jmaloy@redhat.com>]

Replace strcpy() with snprintf() when copying the helper socket path
into sun_path, preventing a potential buffer overflow from a long
argument and guaranteeing null-termination.

In target.c, move the argc check before accessing argv[4], so we
don't dereference past the end of argv.

Signed-off-by: Jon Maloy <jmaloy@redhat.com>

---
v2: Use snprintf() instead of strncpy() for clarity and
    guaranteed null-termination, as suggested by David Gibson
---
 doc/migration/source.c | 2 +-
 doc/migration/target.c | 8 +++-----
 2 files changed, 4 insertions(+), 6 deletions(-)

diff --git a/doc/migration/source.c b/doc/migration/source.c
index d44ebf1f..8aad0259 100644
--- a/doc/migration/source.c
+++ b/doc/migration/source.c
@@ -47,7 +47,7 @@ int main(int argc, char **argv)
 		return -1;
 	}
 
-	strcpy(a_helper.sun_path, argv[4]);
+	snprintf(a_helper.sun_path, sizeof(a_helper.sun_path), "%s", argv[4]);
 	getaddrinfo(argv[1], argv[2], &hints, &r);
 
 	/* Connect socket to server and send some data */
diff --git a/doc/migration/target.c b/doc/migration/target.c
index f7d31083..e2469837 100644
--- a/doc/migration/target.c
+++ b/doc/migration/target.c
@@ -38,11 +38,6 @@ int main(int argc, char **argv)
 	struct cmsghdr *cmsg = CMSG_FIRSTHDR(&msg);
 	struct addrinfo *r;
 
-	(void)argc;
-
-	strcpy(a_helper.sun_path, argv[4]);
-	getaddrinfo(argv[1], argv[2], &hints, &r);
-
 	if (argc != 7) {
 		fprintf(stderr,
 			"%s DST_ADDR DST_PORT SRC_PORT HELPER_PATH SSEQ RSEQ\n",
@@ -50,6 +45,9 @@ int main(int argc, char **argv)
 		return -1;
 	}
 
+	snprintf(a_helper.sun_path, sizeof(a_helper.sun_path), "%s", argv[4]);
+	getaddrinfo(argv[1], argv[2], &hints, &r);
+
 	/* Prepare socket, bind to source port */
 	s = socket(r->ai_family, SOCK_STREAM, IPPROTO_TCP);
 	setsockopt(s, SOL_SOCKET, SO_REUSEADDR, &((int){ 1 }), sizeof(int));
-- 
2.52.0