Change the strcpy to an appropriate strncpy to add a constraint to prevent possible buffer overflow:
/* Sign a module file using the given key.
*
* Copyright © 2014-2015 Red Hat, Inc. All Rights Reserved.
* Copyright © 2015 Intel Corporation.
*
* Authors: David Howells
* David Woodhouse
*
*/
static int pem_pw_cb(char *buf, int len, int w, void *v)
{
int pwlen;
if (!key_pass)
return -1;
pwlen = strlen(key_pass);
if (pwlen >= len)
return -1;
strcpy(buf, key_pass); // HERE
/* If it's wrong, don't keep trying it. */
key_pass = NULL;
return pwlen;
}