Use [v]snprintf or asprintf instead of unchecked sprintf and separate allocation...

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@19709 dc483132-0cff-0310-8789-dd5450dbe970

diff --git a/src/appl/bsd/v4rcp.c b/src/appl/bsd/v4rcp.c
index 71b1b8da4c4c2b06e4a8600069c7478db7b8946a..3cb7b3f97d7d3007db3448afac859992f7adce50 100644 (file)
--- a/src/appl/bsd/v4rcp.c
+++ b/src/appl/bsd/v4rcp.c
@@ -812,8 +812,9 @@ void sink(argc, argv)
                        SCREWUP("size not delimited");
                if (targisdir) {
                        if (strlen(targ) + strlen(cp) + 1 < sizeof(nambuf)) {
-                               (void) sprintf(nambuf, "%s%s%s", targ,
-                                   *targ ? "/" : "", cp);
+                           (void) snprintf(nambuf, sizeof(nambuf),
+                                           "%s%s%s", targ,
+                                           *targ ? "/" : "", cp);
                        } else {
                                SCREWUP("target directory name too long");
                        }

diff --git a/src/appl/telnet/telnetd/telnetd.c b/src/appl/telnet/telnetd/telnetd.c
index 725075d377c350ae950aa599316127b2157ad740..4115b6671239a916479c4c81aa895fca4551fa2b 100644 (file)
--- a/src/appl/telnet/telnetd/telnetd.c
+++ b/src/appl/telnet/telnetd/telnetd.c
@@ -201,15 +201,18 @@ get_default_IM()
        static char banner[1024];
        
        if (uname(&name) < 0)
-               sprintf(banner, "\r\nError getting hostname: %s\r\n",
-                   strerror(errno));
+           snprintf(banner, sizeof(banner),
+                    "\r\nError getting hostname: %s\r\n",
+                    strerror(errno));
         else {
 #if defined(_AIX)
-               sprintf(banner, "\r\n    %%h (%s release %s.%s) (%%t)\r\n\r\n",
-                   name.sysname, name.version, name.release);
+           snprintf(banner, sizeof(banner),
+                    "\r\n    %%h (%s release %s.%s) (%%t)\r\n\r\n",
+                    name.sysname, name.version, name.release);
 #else
-               sprintf(banner, "\r\n    %%h (%s release %s %s) (%%t)\r\n\r\n",
-                   name.sysname, name.release, name.version);
+           snprintf(banner, sizeof(banner),
+                    "\r\n    %%h (%s release %s %s) (%%t)\r\n\r\n",
+                    name.sysname, name.release, name.version);
 #endif
        }
        return banner;
@@ -966,10 +969,10 @@ static void doit(who)
        if (secflag) {
                char slave_dev[16];
 /*xxx This code needs to be fixed to work without ptynum; I don't understand why they don't currently use line, so I don't really know how to fix.*/
-               sprintf(tty_dev, "/dev/pty/%03d", ptynum);
+               snprintf(tty_dev, sizeof(tty_dev), "/dev/pty/%03d", ptynum);
                if (setdevs(tty_dev, &dv) < 0)
                        fatal(net, "cannot set pty security");
-               sprintf(slave_dev, "/dev/ttyp%03d", ptynum);
+               snprintf(slave_dev, sizeof(slave_dev), "/dev/ttyp%03d", ptynum);
                if (setdevs(slave_dev, &dv) < 0)
                        fatal(net, "cannot set tty security");
        }

diff --git a/src/appl/telnet/telnetd/utility.c b/src/appl/telnet/telnetd/utility.c
index a091d089429ccb72fdc2447581977dc894dbe3f6..4a4c1308e5ce50f52426dbb2cbd4b086234ed968 100644 (file)
--- a/src/appl/telnet/telnetd/utility.c
+++ b/src/appl/telnet/telnetd/utility.c
@@ -516,7 +516,7 @@ fatal(f, msg)
 {
        char buf[BUFSIZ];
 
-       (void) sprintf(buf, "telnetd: %s.\r\n", msg);
+       (void) snprintf(buf, sizeof(buf), "telnetd: %s.\r\n", msg);
 #ifdef ENCRYPTION
        if (encrypt_output) {
                /*
@@ -539,7 +539,7 @@ fatalperror(f, msg)
 {
        char buf[BUFSIZ], *strerror();
 
-       (void) sprintf(buf, "%s: %s\r\n", msg, strerror(errno));
+       (void) snprintf(buf, sizeof(buf), "%s: %s\r\n", msg, strerror(errno));
        fatal(f, buf);
 }
 

diff --git a/src/clients/kinit/kinit.c b/src/clients/kinit/kinit.c
index 8037d8536f608d305364cb80963841435ccd74f1..46d7431a8daf894d13d02b242a50dc2becdfe0f9 100644 (file)
--- a/src/clients/kinit/kinit.c
+++ b/src/clients/kinit/kinit.c
@@ -717,9 +717,10 @@ k4_begin(opts, k4)
        krb_get_lrealm(k4->realm, 1);
 
     if (k4->inst[0])
-       sprintf(k4->name, "%s.%s@%s", k4->aname, k4->inst, k4->realm);
+       snprintf(k4->name, sizeof(k4->name), "%s.%s@%s",
+                k4->aname, k4->inst, k4->realm);
     else
-       sprintf(k4->name, "%s@%s", k4->aname, k4->realm);
+       snprintf(k4->name, sizeof(k4->name), "%s@%s", k4->aname, k4->realm);
     opts->principal_name = k4->name;
 
  skip:
@@ -982,7 +983,8 @@ k4_kinit(opts, k4, ctx)
            krb5_error_code code;
            char prompt[1024];
 
-           sprintf(prompt, "Password for %s", opts->principal_name);
+           snprintf(prompt, sizeof(prompt),
+                    "Password for %s", opts->principal_name);
            stash_password[0] = 0;
            /*
              Note: krb5_read_password does not actually look at the
@@ -1038,13 +1040,12 @@ static char*
 getvprogname(v, progname)
     char *v, *progname;
 {
-    unsigned int len = strlen(progname) + 2 + strlen(v) + 2;
-    char *ret = malloc(len);
-    if (ret)
-       sprintf(ret, "%s(v%s)", progname, v);
+    char *ret;
+
+    if (asprintf(&ret, "%s(v%s)", progname, v) < 0)
+       return progname;
     else
-       ret = progname;
-    return ret;
+       return ret;
 }
 
 #ifdef HAVE_KRB524

diff --git a/src/clients/klist/klist.c b/src/clients/klist/klist.c
index 6cf7ce16aa1c49cf66c007f2dfbab610e312f819..f1a251c660244ecc9b5c9fe2faff262e47f1bcf1 100644 (file)
--- a/src/clients/klist/klist.c
+++ b/src/clients/klist/klist.c
@@ -486,7 +486,7 @@ etype_string(enctype)
     
     if ((retval = krb5_enctype_to_string(enctype, buf, sizeof(buf)))) {
        /* XXX if there's an error != EINVAL, I should probably report it */
-       sprintf(buf, "etype %d", enctype);
+       snprintf(buf, sizeof(buf), "etype %d", enctype);
     }
 
     return buf;

diff --git a/src/kadmin/cli/keytab.c b/src/kadmin/cli/keytab.c
index 297b7994ea8b9494d1610c1909cf3f025b310217..89fbe66b1f8b880f5c02c1c6e4c614d11e66d8f1 100644 (file)
--- a/src/kadmin/cli/keytab.c
+++ b/src/kadmin/cli/keytab.c
@@ -99,15 +99,11 @@ static int process_keytab(krb5_context my_context, char **keytab_str,
                    return 1;
               }
          } else {
-              char *tmp = *keytab_str;
-
-              *keytab_str = (char *)
-                   malloc(strlen("WRFILE:")+strlen(tmp)+1);
-              if (*keytab_str == NULL) {
-                   com_err(whoami, ENOMEM, "while creating keytab name");
-                   return 1;
+              if (asprintf(keytab_str, "WRFILE:%s", *keytab_str) < 0) {
+                  *keytab_str = NULL;
+                  com_err(whoami, ENOMEM, "while creating keytab name");
+                  return 1;
               }
-              sprintf(*keytab_str, "WRFILE:%s", tmp);
          }
          
          code = krb5_kt_resolve(my_context, *keytab_str, keytab);
@@ -488,7 +484,7 @@ static char *etype_string(enctype)
     krb5_error_code ret;
 
     if ((ret = krb5_enctype_to_string(enctype, buf, sizeof(buf))))
-       sprintf(buf, "etype %d", enctype);
+       snprintf(buf, sizeof(buf), "etype %d", enctype);
 
     return buf;
 }

diff --git a/src/slave/kpropd.c b/src/slave/kpropd.c
index 77c2703917348f2997a0ee9603c6045a6c20d60d..4436ed2ab7a1829d5e1a4fa18c3d26a32bebd071 100644 (file)
--- a/src/slave/kpropd.c
+++ b/src/slave/kpropd.c
@@ -394,7 +394,7 @@ kpropd_com_err_proc(whoami, code, fmt, args)
 
        error_buf[0] = '\0';
        if (fmt)
-               vsprintf(error_buf, fmt, args);
+           vsnprintf(error_buf, sizeof(error_buf), fmt, args);
        syslog(LOG_ERR, "%s%s%s%s%s", whoami ? whoami : "", whoami ? ": " : "",
               code ? error_message(code) : "", code ? " " : "", error_buf);
 }