Ticket #47835 - Coverity: 12687..12692

12692 - Use of untrusted string value
Description: lines read from the sysconfig reload task's attribute
sysconfigfile (e.g., /etc/sysconfig/dirsrv-localhost) could be tainted.
Check the end of the line more rigorously, and eliminate a chance to
overflow env_var and env_value by copying the characters from read
line.

Reviewed by [email protected] (Thanks, Rich!)

https://fedorahosted.org/389/ticket/47835

ldap/servers/slapd/task.c

@@ -1949,6 +1949,8 @@ task_sysconfig_reload_add(Slapi_PBlock *pb, Slapi_Entry *e, Slapi_Entry *eAfter,
     if ( file != NULL ){
         char line[4096];
         char *s = NULL;
+        /* fgets() reads in at most one less than size characters */
+        char *end_of_line = line + sizeof(line) - 1;
 
         if(logchanges){
             LDAPDebug(LDAP_DEBUG_ANY, "sysconfig reload task: processing file (%s)\n",
@@ -1960,8 +1962,8 @@ task_sysconfig_reload_add(Slapi_PBlock *pb, Slapi_Entry *e, Slapi_Entry *eAfter,
                 /* skip comments */
                 continue;
             } else {
-                char env_value[4096];
-                char env_var[4096];
+                char env_value[sizeof(line)];
+                char env_var[sizeof(line)];
                 int using_setenv = 0;
                 int value_index = 0;
                 int start_value = 0;
@@ -1997,7 +1999,7 @@ task_sysconfig_reload_add(Slapi_PBlock *pb, Slapi_Entry *e, Slapi_Entry *eAfter,
                         using_setenv = 1;
                     }
                     if(strncmp(s, "export ", 7) == 0){
-                    	/* strip off "export " */
+                        /* strip off "export " */
                         s = s + 7;
                     } else if(strncmp(s, "set ", 4) == 0){
                         /* strip off "set " */
@@ -2021,7 +2023,7 @@ task_sysconfig_reload_add(Slapi_PBlock *pb, Slapi_Entry *e, Slapi_Entry *eAfter,
                 /*
                  * Start parsing the names and values
                  */
-                for (; s && *s; s++){
+                for (; s && (s < end_of_line) && *s; s++){
                     /*
                      * If using "setenv", allow the first space/tab only, and start on the env value
                      */