os_ crypto

Some cosmetic and security related changes in os_crypto.
See single commits for details.
Error are of two types with snprintf: truncation and memory allocation. 

In this case both would mangle the output but not the security or integrity of the process(petty sure anyway).  You might be right that snprintf with a memory allocation failure could end in a weird state but then so would all calls to snprintf in the code base and we do a lot of them without checks (right or wrong it's what's there now).  I think snprintf in this use case is far better choice the strcat/strncat.  




> On Jul 7, 2014, at 8:17 AM, "ddpbsd" <notifications@github.com> wrote:
> 
> In src/os_crypto/md5_sha1/md5_sha1_op.c:
> 
> > @@ -46,12 +44,11 @@ int OS_MD5_SHA1_File(char *fname, char *prefilter_cmd, char *md5output, char *sh
> >  	if(!fp)
> >  	    return(-1);
> >      } else {
> > -	strncpy(cmd, prefilter_cmd, sizeof(cmd) - 1);
> > -	strcat(cmd, " ");
> > -	strncat(cmd, fname, sizeof(cmd) - strlen(cmd) - 1);
> > -	fp = popen(cmd, "r");
> > -	if(!fp)
> > -	    return(-1);
> > +        char cmd[OS_MAXSTR];
> > +        snprintf(cmd, sizeof(cmd), "%s %s", prefilter_cmd, fname);
> Would error checking snprintf be a good thing?
> 
> —
> Reply to this email directly or view it on GitHub.