Avoid unchecked sprintf in some KDC-side programs

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@19705 dc483132-0cff-0310-8789-dd5450dbe970

diff --git a/src/kadmin/server/misc.c b/src/kadmin/server/misc.c
index ed511004859b689d1b8ead7bc299fea9f5bfcb74..06e3cdb6154573ffc31470e11c9f5df2fbbe3372 100644 (file)
--- a/src/kadmin/server/misc.c
+++ b/src/kadmin/server/misc.c
@@ -153,7 +153,7 @@ check_min_life(void *server_handle, krb5_principal principal,
                } else {
                    if (*(ptr = &time_string[strlen(time_string)-1]) == '\n')
                        *ptr = '\0';
-                   sprintf(msg_ret, errstr, time_string);
+                   snprintf(msg_ret, msg_len, errstr, time_string);
                }
            }
 

diff --git a/src/kadmin/server/ovsec_kadmd.c b/src/kadmin/server/ovsec_kadmd.c
index a3ce421893fde9d14adca3357d99a5fce6e1a723..be5580db520c836c52bf5ca9ff98043c7582ac1e 100644 (file)
--- a/src/kadmin/server/ovsec_kadmd.c
+++ b/src/kadmin/server/ovsec_kadmd.c
@@ -467,7 +467,7 @@ int main(int argc, char *argv[])
          fprintf(stderr, "%s: Cannot bind socket.\n", whoami);
          fprintf(stderr, "bind: %s\n", e_txt);
          errno = oerrno;
-         sprintf(portbuf, "%d", ntohs(addr.sin_port));
+         snprintf(portbuf, sizeof(portbuf), "%d", ntohs(addr.sin_port));
          krb5_klog_syslog(LOG_ERR, "cannot bind simple chpw socket: %s",
                           e_txt);
          if(oerrno == EADDRINUSE) {
@@ -924,14 +924,12 @@ char *build_princ_name(char *name, char *realm)
 {
      char *fullname;
 
-     fullname = (char *) malloc(strlen(name) + 1 +
-                               (realm ? strlen(realm) + 1 : 0));
-     if (fullname == NULL)
-         return NULL;
-     if (realm)
-         sprintf(fullname, "%s@%s", name, realm);
-     else
-         strcpy(fullname, name);
+     if (realm) {
+        if (asprintf(&fullname, "%s@%s", name, realm) < 0)
+            fullname = NULL;
+     } else
+        fullname = strdup(name);
+
      return fullname;
 }
 

diff --git a/src/kadmin/server/schpw.c b/src/kadmin/server/schpw.c
index e974beb7b296bfd5fe029fa22d74410021660c3b..3d1d47955b62cd2e9eaa77ca4e2fcfc6d0dadbec 100644 (file)
--- a/src/kadmin/server/schpw.c
+++ b/src/kadmin/server/schpw.c
@@ -80,8 +80,8 @@ process_chpw_request(context, server_handle, realm, s, keytab, sockin,
     if (vno != 1) {
        ret = KRB5KDC_ERR_BAD_PVNO;
        numresult = KRB5_KPASSWD_BAD_VERSION;
-       sprintf(strresult,
-               "Request contained unknown protocol version number %d", vno);
+       snprintf(strresult, sizeof(strresult),
+                "Request contained unknown protocol version number %d", vno);
        goto chpwfail;
     }
 

diff --git a/src/kdc/kdc_util.c b/src/kdc/kdc_util.c
index 2a28f4fa6e73e5f5191fba13fcbea9c3e6f32794..82154d6cd2d7fcc9510adc0b420d0d1c8be86099 100644 (file)
--- a/src/kdc/kdc_util.c
+++ b/src/kdc/kdc_util.c
@@ -1523,9 +1523,9 @@ ktypes2str(char *s, size_t len, int nktypes, krb5_enctype *ktype)
        return;
     }
 
-    sprintf(s, "%d etypes {", nktypes);
+    snprintf(s, len, "%d etypes {", nktypes);
     for (i = 0; i < nktypes; i++) {
-       sprintf(stmp, "%s%ld", i ? " " : "", (long)ktype[i]);
+       snprintf(stmp, sizeof(stmp), "%s%ld", i ? " " : "", (long)ktype[i]);
        if (strlen(s) + strlen(stmp) + sizeof("}") > len)
            break;
        strcat(s, stmp);
@@ -1560,18 +1560,19 @@ rep_etypes2str(char *s, size_t len, krb5_kdc_rep *rep)
        return;
     }
 
-    sprintf(s, "etypes {rep=%ld", (long)rep->enc_part.enctype);
+    snprintf(s, len, "etypes {rep=%ld", (long)rep->enc_part.enctype);
 
     if (rep->ticket != NULL) {
-       sprintf(stmp, " tkt=%ld", (long)rep->ticket->enc_part.enctype);
+       snprintf(stmp, sizeof(stmp),
+                " tkt=%ld", (long)rep->ticket->enc_part.enctype);
        strcat(s, stmp);
     }
 
     if (rep->ticket != NULL
        && rep->ticket->enc_part2 != NULL
        && rep->ticket->enc_part2->session != NULL) {
-       sprintf(stmp, " ses=%ld",
-               (long)rep->ticket->enc_part2->session->enctype);
+       snprintf(stmp, sizeof(stmp), " ses=%ld",
+                (long)rep->ticket->enc_part2->session->enctype);
        strcat(s, stmp);
     }
     strcat(s, "}");

diff --git a/src/kdc/kerberos_v4.c b/src/kdc/kerberos_v4.c
index d8daa7924178a5194ae01ade4bd9e7b51e57f7b0..e31826f5eb67aa718dde7337344dba362de96b90 100644 (file)
--- a/src/kdc/kerberos_v4.c
+++ b/src/kdc/kerberos_v4.c
@@ -293,7 +293,9 @@ static char * v4_klog( int type, const char *format, ...)
     case L_TKT_REQ:
     case L_APPL_REQ:
        strcpy(log_text, "PROCESS_V4:");
-       vsprintf(log_text+strlen(log_text), format, pvar);
+       vsnprintf(log_text+strlen(log_text),
+                 sizeof(log_text) - strlen(log_text),
+                 format, pvar);
        krb5_klog_syslog(logpri, "%s", log_text);
     default:
        /* ignore the other types... */
@@ -327,7 +329,7 @@ hang(void)
             pause(); */
     } else {
         char buf[256];
-        sprintf(buf,
+        snprintf(buf, sizeof(buf),
           "Kerberos will wait %d seconds before dying so as not to loop init",
                (int) pause_int);
         klog(L_KRB_PERR, buf);
@@ -564,7 +566,7 @@ kerb_get_principal(char *name, char *inst, /* could have wild cards */
          toggle ^= 1;
          date = &principal->mod_date, text = principal->mod_date_txt) {
        tp = localtime( (time_t *) date);
-       sprintf( text, "%4d-%02d-%02d",
+       snprintf(text, sizeof(principal->mod_date_txt), "%4d-%02d-%02d",
                 tp->tm_year > 1900 ? tp->tm_year : tp->tm_year + 1900,
                 tp->tm_mon + 1, tp->tm_mday); /* January is 0, not 1 */
     }

diff --git a/src/kdc/main.c b/src/kdc/main.c
index e6538d3c35d4fdafcf440282e3cd595d6f774f9a..5540c18a3bdea14ee1a00ad71e836901d315baa1 100644 (file)
--- a/src/kdc/main.c
+++ b/src/kdc/main.c
@@ -504,17 +504,13 @@ initialize_realms(krb5_context kcontext, int argc, char **argv)
            break;
        case 'd':                       /* pathname for db */
            /* now db_name is not a seperate argument. It has to be passed as part of the db_args */
-           if( db_name == NULL )
-           {
-               db_name = malloc(sizeof("dbname=") + strlen(optarg));
-               if( db_name == NULL )
-               {
-                       fprintf(stderr,"%s: KDC cannot initialize. Not enough memory\n",
-                               argv[0] );
-                       exit(1);
+           if( db_name == NULL ) {
+               if (asprintf(&db_name, "dbname=%s", optarg) < 0) {
+                   fprintf(stderr,
+                           "%s: KDC cannot initialize. Not enough memory\n",
+                           argv[0]);
+                   exit(1);
                }
-
-               sprintf( db_name, "dbname=%s", optarg);
            }
 
            db_args_size++;

diff --git a/src/plugins/kdb/db2/kdb_db2.c b/src/plugins/kdb/db2/kdb_db2.c
index d438171cbdb0fe670f5eb3285f1256986862f9ba..bce6597519d0491a5beeebd229c4eae4988b8e7e 100644 (file)
--- a/src/plugins/kdb/db2/kdb_db2.c
+++ b/src/plugins/kdb/db2/kdb_db2.c
@@ -337,9 +337,11 @@ krb5_db2_db_init(krb5_context context)
     if ((retval = krb5_db2_db_get_age(context, NULL, &db_ctx->db_lf_time)))
        goto err_out;
 
-    sprintf(policy_db_name, db_ctx->tempdb ? "%s~.kadm5" : "%s.kadm5",
-           db_ctx->db_name);
-    sprintf(policy_lock_name, "%s.lock", policy_db_name);
+    snprintf(policy_db_name, sizeof(policy_db_name),
+            db_ctx->tempdb ? "%s~.kadm5" : "%s.kadm5",
+            db_ctx->db_name);
+    snprintf(policy_lock_name, sizeof(policy_lock_name),
+            "%s.lock", policy_db_name);
 
     if ((retval = osa_adb_init_db(&db_ctx->policy_db, policy_db_name,
                                  policy_lock_name, OSA_ADB_POLICY_DB_MAGIC)))
@@ -720,8 +722,9 @@ krb5_db2_db_create(krb5_context context, char *db_name, krb5_int32 flags)
        free_dbsuffix(okname);
     }
 
-    sprintf(policy_db_name, "%s.kadm5", db_name2);
-    sprintf(policy_lock_name, "%s.lock", policy_db_name);
+    snprintf(policy_db_name, sizeof(policy_db_name), "%s.kadm5", db_name2);
+    snprintf(policy_lock_name, sizeof(policy_lock_name),
+            "%s.lock", policy_db_name);
 
     retval = osa_adb_create_db(policy_db_name,
                               policy_lock_name, OSA_ADB_POLICY_DB_MAGIC);
@@ -851,8 +854,9 @@ krb5_db2_db_destroy(krb5_context context, char *dbname)
     if (retval1 || retval2)
        return (retval1 ? retval1 : retval2);
 
-    sprintf(policy_db_name, "%s.kadm5", dbname);
-    sprintf(policy_lock_name, "%s.lock", policy_db_name);
+    snprintf(policy_db_name, sizeof(policy_db_name), "%s.kadm5", dbname);
+    snprintf(policy_lock_name, sizeof(policy_lock_name),
+            "%s.lock", policy_db_name);
 
     retval1 = osa_adb_destroy_db(policy_db_name,
                                 policy_lock_name, OSA_ADB_POLICY_DB_MAGIC);
@@ -1694,8 +1698,9 @@ krb5_db2_db_rename(context, from, to)
           now.  */
        char    policy[2048], new_policy[2048];
        assert (strlen(db_ctx->db_name) < 2000);
-       sprintf(policy, "%s.kadm5", db_ctx->db_name);
-       sprintf(new_policy, "%s~.kadm5", db_ctx->db_name);
+       snprintf(policy, sizeof(policy), "%s.kadm5", db_ctx->db_name);
+       snprintf(new_policy, sizeof(new_policy),
+                "%s~.kadm5", db_ctx->db_name);
        if (0 != rename(new_policy, policy)) {
            retval = errno;
            goto errout;

diff --git a/src/plugins/kdb/db2/libdb2/btree/bt_open.c b/src/plugins/kdb/db2/libdb2/btree/bt_open.c
index dbdaff9e0a2b327113e55016128938aab4130427..a18eef2cf6c5574154e3c81e34cff5217fde1208 100644 (file)
--- a/src/plugins/kdb/db2/libdb2/btree/bt_open.c
+++ b/src/plugins/kdb/db2/libdb2/btree/bt_open.c
@@ -414,7 +414,8 @@ tmp()
        if (envtmp && ((strlen(envtmp)+sizeof(fn)+1) > sizeof(path)))
            return(-1);
 
-       (void)sprintf(path, "%s%s", (envtmp ? envtmp : "/tmp"), fn);
+       (void)snprintf(path, sizeof(path),
+                      "%s%s", (envtmp ? envtmp : "/tmp"), fn);
 
 #ifdef SIG_BLOCK
        (void)sigfillset(&set);