1 files changed, 18 insertions, 32 deletions

diff --git a/lib/vty.c b/lib/vty.c
index 0568351989..ce6349bf77 100644
--- a/lib/vty.c
+++ b/lib/vty.c
@@ -1993,7 +1993,7 @@ vty_serv_un (const char *path)
   /* Make server socket. */
   memset (&serv, 0, sizeof (struct sockaddr_un));
   serv.sun_family = AF_UNIX;
-  strncpy (serv.sun_path, path, strlen (path));
+  strlcpy (serv.sun_path, path, sizeof (serv.sun_path));
 #ifdef HAVE_STRUCT_SOCKADDR_UN_SUN_LEN
   len = serv.sun_len = SUN_LEN(&serv);
 #else
@@ -2357,7 +2357,6 @@ vty_use_backup_config (char *fullpath)
 {
   char *fullpath_sav, *fullpath_tmp;
   FILE *ret = NULL;
-  struct stat buf;
   int tmp, sav;
   int c;
   char buffer[512];
@@ -2365,7 +2364,9 @@ vty_use_backup_config (char *fullpath)
   fullpath_sav = malloc (strlen (fullpath) + strlen (CONF_BACKUP_EXT) + 1);
   strcpy (fullpath_sav, fullpath);
   strcat (fullpath_sav, CONF_BACKUP_EXT);
-  if (stat (fullpath_sav, &buf) == -1)
+
+  sav = open (fullpath_sav, O_RDONLY);
+  if (sav < 0)
     {
       free (fullpath_sav);
       return NULL;
@@ -2377,48 +2378,33 @@ vty_use_backup_config (char *fullpath)
   /* Open file to configuration write. */
   tmp = mkstemp (fullpath_tmp);
   if (tmp < 0)
-    {
-      free (fullpath_sav);
-      free (fullpath_tmp);
-      return NULL;
-    }
+    goto out_close_sav;
 
-  sav = open (fullpath_sav, O_RDONLY);
-  if (sav < 0)
-    {
-      unlink (fullpath_tmp);
-      free (fullpath_sav);
-      free (fullpath_tmp);
-      return NULL;
-    }
+  if (fchmod (tmp, CONFIGFILE_MASK) != 0)
+    goto out_close;
 
   while((c = read (sav, buffer, 512)) > 0)
     {
       if (write (tmp, buffer, c) <= 0)
-        {
-          free (fullpath_sav);
-          free (fullpath_tmp);
-          close (sav);
-          close (tmp);
-          return NULL;
-        }
+        goto out_close;
     }
   close (sav);
   close (tmp);
 
-  if (chmod(fullpath_tmp, CONFIGFILE_MASK) != 0)
+  if (rename (fullpath_tmp, fullpath) == 0)
+    ret = fopen (fullpath, "r");
+  else
+    unlink (fullpath_tmp);
+
+  if (0)
     {
+out_close:
+      close (tmp);
       unlink (fullpath_tmp);
-      free (fullpath_sav);
-      free (fullpath_tmp);
-      return NULL;
+out_close_sav:
+      close (sav);
     }
 
-  if (link (fullpath_tmp, fullpath) == 0)
-    ret = fopen (fullpath, "r");
-
-  unlink (fullpath_tmp);
-
   free (fullpath_sav);
   free (fullpath_tmp);
   return ret;