thttpd/thttpd-2.25b-overflow.diff

Index: extras/htpasswd.c
===================================================================
--- extras/htpasswd.c.orig	2018-10-22 10:48:47.811465609 +0200
+++ extras/htpasswd.c	2018-10-22 10:52:45.008744706 +0200
@@ -193,7 +193,8 @@ int main(int argc, char *argv[]) {
             putline(tfp,line);
             continue;
         }
-        strcpy(l,line);
+        strncpy(l,line,MAX_STRING_LEN);
+        l[MAX_STRING_LEN-1]='\0';
         getword(w,l,':');
         if(strcmp(user,w)) {
             putline(tfp,line);
@@ -211,7 +212,8 @@ int main(int argc, char *argv[]) {
     }
     fclose(f);
     fclose(tfp);
-    sprintf(command,"cp %s %s",temp_template,argv[1]);
+    snprintf(command,MAX_STRING_LEN,"cp %s %s",temp_template,argv[1]);
+    command[MAX_STRING_LEN-1]='\0';
     system(command);
     unlink(temp_template);
     exit(0);