Eliminate use of strcpy/strcat/sprintf in wconfig.c. Use memcpy since

we cannot rely on libkrb5support to give us the good stuff.  Also fix
up (to some extent) an assumption that size_t == int.

ticket: 6200
status: open

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@20930 dc483132-0cff-0310-8789-dd5450dbe970

diff --git a/src/wconfig.c b/src/wconfig.c
index a2ec5b00561964c9ab36eac33fefded6d05fff40..27531b8e23f133eac9e8c12a314ae57eb80f8499 100644 (file)
--- a/src/wconfig.c
+++ b/src/wconfig.c
@@ -57,9 +57,10 @@ int main(int argc, char *argv[])
 {
        char *ignore_str = "--ignore=";
        int ignore_len;
-       char *cp, tmp[80];
+       char *cp, *tmp;
        char *win_flag;
        char wflags[1024];
+       size_t wlen, alen;
 
 #ifdef _WIN32
        win_flag = win32_flag;
@@ -67,21 +68,22 @@ int main(int argc, char *argv[])
        win_flag = "UNIX##";
 #endif
 
-       wflags[0] = 0;
+       wlen = 0;
 
        ignore_len = strlen(ignore_str);
        argc--; argv++;
        while (*argv && *argv[0] == '-') {
-               wflags[sizeof(wflags) - 1] = '\0';
-               if (strlen (wflags) + 1 + strlen (*argv) > sizeof (wflags) - 1) {
+               alen = strlen(*argv);
+               if (wlen + 1 + alen > sizeof (wflags) - 1) {
                        fprintf (stderr,
-                                "wconfig: argument list too long (internal limit %d)",
-                                sizeof (wflags));
+                                "wconfig: argument list too long (internal limit %lu)",
+                                (unsigned long) sizeof (wflags));
                        exit (1);
                }
-               if (wflags[0])
-                       strcat(wflags, " ");
-               strcat(wflags, *argv);
+               if (wlen > 0)
+                       wflags[wlen++] = ' ';
+               memcpy(&wflags[wlen], *argv, alen);
+               wlen += alen;
 
                if (!strcmp(*argv, "--mit")) {
                        mit_specific = 1;
@@ -99,18 +101,19 @@ int main(int argc, char *argv[])
                        continue;
                }
                if (!strncmp(*argv, "--enable-", 9)) {
-                       sprintf(tmp, "%s##", (*argv)+ignore_len);
-                       for (cp = tmp; *cp; cp++) {
-                               if (islower(*cp))
-                                       *cp = toupper(*cp);
-                       }
-                       cp = strdup(tmp);
-                       if (!cp) {
+                       tmp = malloc(alen - ignore_len + 3);
+                       if (!tmp) {
                                fprintf(stderr,
                                        "wconfig: malloc failed!\n");
                                exit(1);
                        }
-                       add_ignore_list(cp);
+                       memcpy(tmp, *argv + ignore_len, alen - ignore_len);
+                       memcpy(tmp + alen - ignore_len, "##", 3);
+                       for (cp = tmp; *cp; cp++) {
+                               if (islower(*cp))
+                                       *cp = toupper(*cp);
+                       }
+                       add_ignore_list(tmp);
                        argc--; argv++;
                        continue;
                }
@@ -122,6 +125,7 @@ int main(int argc, char *argv[])
                fprintf(stderr, "Invalid option: %s\n", *argv);
                exit(1);
        }
+       wflags[wlen] = '\0';
 
        if (win_flag)
                add_ignore_list(win_flag);
@@ -174,16 +178,25 @@ copy_file (char *path, char *fname)
     FILE *fin;
     char buf[1024];
     char **cpp, *ptr;
-    int len;
+    size_t len, plen, flen;
 
     if (strcmp(fname, "-") == 0) {
            fin = stdin;
     } else {
+           plen = strlen(path);
+           flen = strlen(fname);
+           if (plen + 1 + flen > sizeof(buf) - 1) {
+                   fprintf(stderr, "Name %s or %s too long", path, fname);
+                   return 1;
+           }
+           memcpy(buf, path, plen);
 #ifdef _WIN32
-           sprintf(buf, "%s\\%s", path, fname);
+           buf[plen] = '\\';
 #else
-           sprintf(buf, "%s/%s", path, fname);
+           buf[plen] = '/';
 #endif
+           memcpy(buf + plen + 1, fname, flen);
+           buf[plen + 1 + flen] = '\0';
            fin = fopen (buf, "r");                     /* File to read */
            if (fin == NULL) {
                    fprintf(stderr, "wconfig: Can't open file %s\n", buf);