zhashfs: fix argv corruption

1 files changed, 5 insertions, 2 deletions

diff --git a/bin/zhashfs.c b/bin/zhashfs.c
index b3b86e0..161bb75 100644
--- a/bin/zhashfs.c
+++ b/bin/zhashfs.c
@@ -82,7 +82,7 @@ int main(int argc, char **argv)
     int		  skip;
 
     unsigned char *pbuf;        // fill pattern buffer
-    char          *pname;       // fill pattern file name
+    char          pname[PATH_MAX];       // fill pattern file name
     FILE          *pfile;       // fill pattern file
     int           patterned, n;
 
@@ -121,7 +121,10 @@ int main(int argc, char **argv)
 
     /* open and read an optional fill pattern file */
     pbuf = NULL;
-    pname = strcat(argv[3], ".fill");
+    strncpy(pname, argv[3], sizeof(pname) - 6);
+    strcat(pname, ".fill");
+    pname[sizeof(pname) - 1] = 0;
+
     pfile = fopen(pname, "rb");
     if (pfile != NULL) {
         pbuf = malloc(PATTERN_SIZE);