NetBSD changes: use POSIX regex routines and fix more buff oflow

Can't use mkstemp() so go back to mktemp and open(2) with sane flags.
Now uses rcmdsh and fixes memory leak in NetBSD POSIX regex support
(leak fixed by Charles Amos <amos@umiacs.umd.edu>).

9 files changed, 89 insertions, 88 deletions

diff --git a/usr.bin/oldrdist/Makefile b/usr.bin/oldrdist/Makefile
index 50c90834344..1ece82a4b5a 100644
--- a/usr.bin/oldrdist/Makefile
+++ b/usr.bin/oldrdist/Makefile
@@ -1,19 +1,14 @@
-#	$OpenBSD: Makefile,v 1.3 1996/07/19 21:57:31 millert Exp $
+#	$OpenBSD: Makefile,v 1.4 1996/08/22 20:33:14 millert Exp $
 
 PROG=	rdist
 CFLAGS+=-I${.CURDIR}
-SRCS=	docmd.c expand.c lookup.c main.c server.c rshrcmd.c
+SRCS=	docmd.c expand.c lookup.c main.c server.c
 OBJS+=	gram.o
 BINOWN=	root
 BINMODE=555
 CLEANFILES=y.tab.h
 MAN=	oldrdist.1
 
-LDADD=	-lcompat
-DPADD=	${LIBCOMPAT}
-
-.PATH:	${.CURDIR}/../rdist
-
 realinstall:
 	install ${COPY} ${STRIP} -o ${BINOWN} -g ${BINGRP} -m ${BINMODE} \
 		${PROG} ${DESTDIR}${BINDIR}/oldrdist
diff --git a/usr.bin/oldrdist/defs.h b/usr.bin/oldrdist/defs.h
index 678e0b6b8b6..35eb532439b 100644
--- a/usr.bin/oldrdist/defs.h
+++ b/usr.bin/oldrdist/defs.h
@@ -1,4 +1,4 @@
-/* *	$OpenBSD: defs.h,v 1.3 1996/07/19 21:57:31 millert Exp $*/
+/* *	$OpenBSD: defs.h,v 1.4 1996/08/22 20:33:16 millert Exp $*/
 /*
  * Copyright (c) 1983, 1993
  *	The Regents of the University of California.  All rights reserved.
@@ -106,11 +106,6 @@
 
 #define ALLOC(x) (struct x *) malloc(sizeof(struct x))
 
-/* so we can use rshrcmd.c from rdist 6.1.x */
-#define SYSERR	strerror(errno)
-#define path_remsh	_PATH_REMSH
-#define getsocketpair	socketpair
-
 struct namelist {	/* for making lists of strings */
 	char	*n_name;
 	struct	namelist *n_next;
@@ -155,7 +150,7 @@ extern struct linkbuf *ihead;	/* list of files with more than one link */
 extern struct passwd *pw;	/* pointer to static area used by getpwent */
 extern struct group *gr;	/* pointer to static area used by getgrent */
 extern char host[];		/* host name of master copy */
-extern char buf[];		/* general purpose buffer */
+extern char buf[BUFSIZ];	/* general purpose buffer */
 
 int	 any __P((int, char *));
 char	*colon __P((char *));
@@ -184,5 +179,6 @@ void	 prnames __P((struct namelist *));
 void	 server __P((void));
 void	 yyerror __P((char *));
 int	 yyparse __P((void));
-int	 rshrcmd __P((char **, u_short, char *, char *, char *, int *));
+/* XXX - move to /usr/include/unistd.h... */
+int	 rcmdsh __P((char **, u_short, char *, char *, char *, char *));
 char	*xbasename __P((char *));
diff --git a/usr.bin/oldrdist/docmd.c b/usr.bin/oldrdist/docmd.c
index 4a179792b46..b6e0f819b98 100644
--- a/usr.bin/oldrdist/docmd.c
+++ b/usr.bin/oldrdist/docmd.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: docmd.c,v 1.6 1996/07/30 20:34:54 millert Exp $	*/
+/*	$OpenBSD: docmd.c,v 1.7 1996/08/22 20:33:17 millert Exp $	*/
 
 /*
  * Copyright (c) 1983, 1993
@@ -35,12 +35,13 @@
 
 #ifndef lint
 /* from: static char sccsid[] = "@(#)docmd.c	8.1 (Berkeley) 6/9/93"; */
-static char *rcsid = "$OpenBSD: docmd.c,v 1.6 1996/07/30 20:34:54 millert Exp $";
+static char *rcsid = "$OpenBSD: docmd.c,v 1.7 1996/08/22 20:33:17 millert Exp $";
 #endif /* not lint */
 
 #include "defs.h"
 #include <setjmp.h>
 #include <netdb.h>
+#include <regex.h>
 
 FILE	*lfp;			/* log file for recording files updated */
 struct	subcmd *subcmds;	/* list of sub-commands for current cmd */
@@ -148,10 +149,10 @@ doarrow(filev, files, rhost, cmds)
 		signal(SIGPIPE, lostconn);
 		if (!makeconn(rhost))
 			return;
-		if ((fd = mkstemp(tempfile)) == -1 ||
+		if ((fd = open(tempfile, O_CREAT|O_EXCL|O_WRONLY, 0600)) < 0 ||
 		    (lfp = fdopen(fd, "w")) == NULL) {
-			if (fd != -1)
-				close(fd);
+			if (fd >= 0)
+				(void) close(fd);
 			fatal("cannot open %s\n", tempfile);
 			exit(1);
 		}
@@ -245,7 +246,7 @@ makeconn(rhost)
 		ruser = user;
 	if (!qflag)
 		printf("updating host %s\n", rhost);
-	(void) snprintf(buf, BUFSIZ, "%s -Server%s", _PATH_RDIST,
+	(void) snprintf(buf, sizeof(buf), "%s -Server%s", _PATH_RDIST,
 		qflag ? " -q" : "");
 #if	defined(DIRECT_RCMD)
 	if (port < 0) {
@@ -272,7 +273,7 @@ makeconn(rhost)
 	rem = rcmd(&rhost, port, user, ruser, buf, 0);
 	seteuid(userid);
 #else	/* !DIRECT_RCMD */
-	rem = rshrcmd(&rhost, -1, user, ruser, buf, 0);
+	rem = rcmdsh(&rhost, -1, user, ruser, buf, NULL);
 #endif	/* !DIRECT_RCMD */
 	if (rem < 0)
 		return(0);
@@ -399,11 +400,11 @@ dodcolon(filev, files, stamp, cmds)
 	else {
 		int fd;
 
-		if ((fd = mkstemp(tempfile)) == -1 ||
+		if ((fd = open(tempfile, O_CREAT|O_EXCL|O_WRONLY, 0600)) < 0 ||
 		    (tfp = fdopen(fd, "w")) == NULL) {
-			if (fd != -1)
-				close(fd);
 			error("%s: %s\n", stamp, strerror(errno));
+			if (fd >= 0)
+				(void) close(fd);
 			return;
 		}
 		(void) gettimeofday(&tv[0], &tz);
@@ -565,7 +566,7 @@ notify(file, rhost, to, lmod)
 	/*
 	 * Create a pipe to mailling program.
 	 */
-	(void) snprintf(buf, BUFSIZ, "%s -oi -t", _PATH_SENDMAIL);
+	(void) snprintf(buf, sizeof(buf), "%s -oi -t", _PATH_SENDMAIL);
 	pf = popen(buf, "w");
 	if (pf == NULL) {
 		error("notify: \"%s\" failed\n", _PATH_SENDMAIL);
@@ -628,6 +629,8 @@ except(file)
 {
 	register struct	subcmd *sc;
 	register struct	namelist *nl;
+	regex_t s;
+	int err;
 
 	if (debug)
 		printf("except(%s)\n", file);
@@ -641,9 +644,15 @@ except(file)
 					return(1);
 				continue;
 			}
-			re_comp(nl->n_name);
-			if (re_exec(file) > 0)
+			if ((err = regcomp(&s, nl->n_name, 0)) != 0) {
+				(void) regerror(err, &s, buf, sizeof(buf));
+				error("%s: %s\n", nl->n_name, buf);
+			}
+			if (regexec(&s, file, 0, NULL, 0) == 0) {
+				regfree(&s);
 				return(1);
+			}
+			regfree(&s);
 		}
 	}
 	return(0);
diff --git a/usr.bin/oldrdist/expand.c b/usr.bin/oldrdist/expand.c
index 1fcd6560ac6..b80a79374ea 100644
--- a/usr.bin/oldrdist/expand.c
+++ b/usr.bin/oldrdist/expand.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: expand.c,v 1.4 1996/07/25 05:13:48 millert Exp $	*/
+/*	$OpenBSD: expand.c,v 1.5 1996/08/22 20:33:18 millert Exp $	*/
 
 /*
  * Copyright (c) 1983, 1993
@@ -35,7 +35,7 @@
 
 #ifndef lint
 /* from: static char sccsid[] = "@(#)expand.c	8.1 (Berkeley) 6/9/93"; */
-static char *rcsid = "$OpenBSD: expand.c,v 1.4 1996/07/25 05:13:48 millert Exp $";
+static char *rcsid = "$OpenBSD: expand.c,v 1.5 1996/08/22 20:33:18 millert Exp $";
 #endif /* not lint */
 
 #include "defs.h"
@@ -183,13 +183,13 @@ expstr(s)
 			*tail = savec;
 		if (tp != NULL) {
 			for (; tp != NULL; tp = tp->n_next) {
-				snprintf(buf, BUFSIZ, "%s%s%s", s,
+				snprintf(buf, sizeof(buf), "%s%s%s", s,
 					tp->n_name, tail);
 				expstr(buf);
 			}
 			return;
 		}
-		snprintf(buf, BUFSIZ, "%s%s", s, tail);
+		snprintf(buf, sizeof(buf), "%s%s", s, tail);
 		expstr(buf);
 		return;
 	}
diff --git a/usr.bin/oldrdist/gram.y b/usr.bin/oldrdist/gram.y
index 8639687a95c..4353c98ab09 100644
--- a/usr.bin/oldrdist/gram.y
+++ b/usr.bin/oldrdist/gram.y
@@ -34,7 +34,7 @@
 
 #ifndef lint
 /* from: static char sccsid[] = "@(#)gram.y	8.1 (Berkeley) 6/9/93"; */
-static char *rcsid = "$Id: gram.y,v 1.1 1996/02/03 12:11:57 dm Exp $";
+static char *rcsid = "$Id: gram.y,v 1.2 1996/08/22 20:33:20 millert Exp $";
 #endif /* not lint */
 
 #include "defs.h"
@@ -163,13 +163,8 @@ cmd:		  INSTALL options opt_namelist SM = {
 			$$ = $1;
 		}
 		| PATTERN namelist SM = {
-			struct namelist *nl;
-			char *cp, *re_comp();
-
-			for (nl = $2; nl != NULL; nl = nl->n_next)
-				if ((cp = re_comp(nl->n_name)) != NULL)
-					yyerror(cp);
-			$1->sc_args = expand($2, E_VARS);
+			if ($2 != NULL)
+				$1->sc_args = expand($2, E_VARS);
 			$$ = $1;
 		}
 		| SPECIAL opt_namelist STRING SM = {
diff --git a/usr.bin/oldrdist/lookup.c b/usr.bin/oldrdist/lookup.c
index b4b0b332652..0da7cd4866f 100644
--- a/usr.bin/oldrdist/lookup.c
+++ b/usr.bin/oldrdist/lookup.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: lookup.c,v 1.4 1996/07/19 21:57:32 millert Exp $	*/
+/*	$OpenBSD: lookup.c,v 1.5 1996/08/22 20:33:21 millert Exp $	*/
 
 /*
  * Copyright (c) 1983, 1993
@@ -35,7 +35,7 @@
 
 #ifndef lint
 /* from: static char sccsid[] = "@(#)lookup.c	8.1 (Berkeley) 6/9/93"; */
-static char *rcsid = "$OpenBSD: lookup.c,v 1.4 1996/07/19 21:57:32 millert Exp $";
+static char *rcsid = "$OpenBSD: lookup.c,v 1.5 1996/08/22 20:33:21 millert Exp $";
 #endif /* not lint */
 
 #include "defs.h"
@@ -129,7 +129,7 @@ lookup(name, action, value)
 	register unsigned n;
 	register char *cp;
 	register struct syment *s;
-	char buf[1024];
+	char buf[BUFSIZ];
 
 	if (debug)
 		printf("lookup(%s, %d, %x)\n", name, action, value);
@@ -144,8 +144,8 @@ lookup(name, action, value)
 			continue;
 		if (action != LOOKUP) {
 			if (action != INSERT || s->s_type != CONST) {
-				(void)snprintf(buf, sizeof buf,
-				    "%s redefined", name);
+				(void)snprintf(buf, sizeof(buf),
+					"%s redefined", name);
 				yyerror(buf);
 			}
 		}
@@ -153,7 +153,7 @@ lookup(name, action, value)
 	}
 
 	if (action == LOOKUP) {
-		(void)snprintf(buf, sizeof buf, "%s undefined", name);
+		(void)snprintf(buf, sizeof(buf), "%s undefined", name);
 		yyerror(buf);
 		return(NULL);
 	}
diff --git a/usr.bin/oldrdist/main.c b/usr.bin/oldrdist/main.c
index cb6960b15b4..2fe055fc013 100644
--- a/usr.bin/oldrdist/main.c
+++ b/usr.bin/oldrdist/main.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: main.c,v 1.4 1996/07/30 20:34:55 millert Exp $	*/
+/*	$OpenBSD: main.c,v 1.5 1996/08/22 20:33:22 millert Exp $	*/
 
 /*
  * Copyright (c) 1983, 1993
@@ -41,7 +41,7 @@ static char copyright[] =
 
 #ifndef lint
 /* from: static char sccsid[] = "@(#)main.c	8.1 (Berkeley) 6/9/93"; */
-static char *rcsid = "$OpenBSD: main.c,v 1.4 1996/07/30 20:34:55 millert Exp $";
+static char *rcsid = "$OpenBSD: main.c,v 1.5 1996/08/22 20:33:22 millert Exp $";
 #endif /* not lint */
 
 #include "defs.h"
@@ -84,7 +84,7 @@ main(argc, argv)
 	char *argv[];
 {
 	register char *arg;
-	int cmdargs = 0;
+	int cmdargs = 0, fd;
 	char *dhosts[NHOSTS], **hp = dhosts;
 
 	pw = getpwuid(userid = getuid());
@@ -198,6 +198,9 @@ main(argc, argv)
 	}
 #endif	/* DIRECT_RCMD */
 
+	if (mktemp(tempfile) == NULL)
+		fatal("cannot get temp file\n");
+
 	if (iamremote) {
 		server();
 		exit(nerrs != 0);
diff --git a/usr.bin/oldrdist/pathnames.h b/usr.bin/oldrdist/pathnames.h
index 0a80d99178c..e741e4be578 100644
--- a/usr.bin/oldrdist/pathnames.h
+++ b/usr.bin/oldrdist/pathnames.h
@@ -1,4 +1,4 @@
-/* *	$OpenBSD: pathnames.h,v 1.3 1996/07/19 21:57:33 millert Exp $*/
+/* *	$OpenBSD: pathnames.h,v 1.4 1996/08/22 20:33:23 millert Exp $*/
 /*
  * Copyright (c) 1989, 1993
  *	The Regents of the University of California.  All rights reserved.
@@ -37,4 +37,3 @@
 #include <paths.h>
 
 #define	_PATH_RDIST	"rdist"
-#define _PATH_REMSH	"/usr/bin/rsh"
diff --git a/usr.bin/oldrdist/server.c b/usr.bin/oldrdist/server.c
index a0f3b749601..9a97cead1f4 100644
--- a/usr.bin/oldrdist/server.c
+++ b/usr.bin/oldrdist/server.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: server.c,v 1.5 1996/07/25 05:13:49 millert Exp $	*/
+/*	$OpenBSD: server.c,v 1.6 1996/08/22 20:33:24 millert Exp $	*/
 
 /*
  * Copyright (c) 1983, 1993
@@ -35,7 +35,7 @@
 
 #ifndef lint
 /* from: static char sccsid[] = "@(#)server.c	8.1 (Berkeley) 6/9/93"; */
-static char *rcsid = "$OpenBSD: server.c,v 1.5 1996/07/25 05:13:49 millert Exp $";
+static char *rcsid = "$OpenBSD: server.c,v 1.6 1996/08/22 20:33:24 millert Exp $";
 #endif /* not lint */
 
 #include <sys/wait.h>
@@ -93,13 +93,15 @@ server()
 
 	rem = 0;
 	oumask = umask(0);
-	(void) snprintf(buf, BUFSIZ, "V%d\n", VERSION);
+	(void) snprintf(buf, sizeof(buf), "V%d\n", VERSION);
 	(void) write(rem, buf, strlen(buf));
 
+#if	!defined(DIRECT_RCMD)
 	if (getuid() != geteuid()) {
 		error("This version of rdist should not be installed setuid.\n");
 		return;
 	}
+#endif	/* DIRECT_RCMD */
 
 	for (;;) {
 		cp = cmdbuf;
@@ -279,7 +281,7 @@ install(src, dest, destdir, opts)
 	/*
 	 * Pass the destination file/directory name to remote.
 	 */
-	(void) snprintf(buf, BUFSIZ, "%c%s\n", destdir ? 'T' : 't', dest);
+	(void) snprintf(buf, sizeof(buf), "%c%s\n", destdir ? 'T' : 't', dest);
 	if (debug)
 		printf("buf = %s", buf);
 	(void) write(rem, buf, strlen(buf));
@@ -342,7 +344,8 @@ sendf(rname, opts)
 			log(lfp, "%s: no name for group %d\n",
 				target, stb.st_gid);
 			gr = NULL;
-			(void) snprintf(group, sizeof(group), ":%lu", stb.st_gid);
+			(void) snprintf(group, sizeof(group), ":%lu",
+				stb.st_gid);
 		}
 	if (u == 1) {
 		if (opts & VERIFY) {
@@ -359,8 +362,9 @@ sendf(rname, opts)
 			error("%s: %s\n", target, strerror(errno));
 			return;
 		}
-		(void) snprintf(buf, BUFSIZ, "D%o %04o 0 0 %s %s %s\n", opts,
-			stb.st_mode & 07777, protoname(), protogroup(), rname);
+		(void) snprintf(buf, sizeof(buf), "D%o %04o 0 0 %s %s %s\n",
+			opts, stb.st_mode & 07777, protoname(), protogroup(),
+			rname);
 		if (debug)
 			printf("buf = %s", buf);
 		(void) write(rem, buf, strlen(buf));
@@ -407,11 +411,12 @@ sendf(rname, opts)
 			if ((lp = savelink(&stb)) != NULL) {
 				/* install link */
 				if (*lp->target == 0)
-				(void) snprintf(buf, BUFSIZ, "k%o %s %s\n",
+				(void) snprintf(buf, sizeof(buf), "k%o %s %s\n",
 					opts, lp->pathname, rname);
 				else
-				(void) snprintf(buf, BUFSIZ, "k%o %s/%s %s\n",
-					opts, lp->target, lp->pathname, rname);
+				(void) snprintf(buf, sizeof(buf),
+					"k%o %s/%s %s\n", opts, lp->target,
+					lp->pathname, rname);
 				if (debug)
 					printf("buf = %s", buf);
 				(void) write(rem, buf, strlen(buf));
@@ -419,7 +424,7 @@ sendf(rname, opts)
 				return;
 			}
 		}
-		(void) snprintf(buf, BUFSIZ, "K%o %o %qd %ld %s %s %s\n",
+		(void) snprintf(buf, sizeof(buf), "K%o %o %qd %ld %s %s %s\n",
 			opts, stb.st_mode & 07777, stb.st_size, stb.st_mtime,
 			protoname(), protogroup(), rname);
 		if (debug)
@@ -455,10 +460,10 @@ sendf(rname, opts)
 		if ((lp = savelink(&stb)) != NULL) {
 			/* install link */
 			if (*lp->target == 0)
-			(void) snprintf(buf, BUFSIZ, "k%o %s %s\n", opts,
+			(void) snprintf(buf, sizeof(buf), "k%o %s %s\n", opts,
 				lp->pathname, rname);
 			else
-			(void) snprintf(buf, BUFSIZ, "k%o %s/%s %s\n",
+			(void) snprintf(buf, sizeof(buf), "k%o %s/%s %s\n",
 				opts, lp->target, lp->pathname, rname);
 			if (debug)
 				printf("buf = %s", buf);
@@ -472,7 +477,7 @@ sendf(rname, opts)
 		error("%s: %s\n", target, strerror(errno));
 		return;
 	}
-	(void) snprintf(buf, BUFSIZ, "R%o %o %qd %ld %s %s %s\n", opts,
+	(void) snprintf(buf, sizeof(buf), "R%o %o %qd %ld %s %s %s\n", opts,
 		stb.st_mode & 07777, stb.st_size, stb.st_mtime,
 		protoname(), protogroup(), rname);
 	if (debug)
@@ -510,7 +515,7 @@ dospecial:
 		log(lfp, "special \"%s\"\n", sc->sc_name);
 		if (opts & VERIFY)
 			continue;
-		(void) snprintf(buf, BUFSIZ, "SFILE=%s;%s\n", target,
+		(void) snprintf(buf, sizeof(buf), "SFILE=%s;%s\n", target,
 			sc->sc_name);
 		if (debug)
 			printf("buf = %s", buf);
@@ -570,7 +575,7 @@ update(rname, opts, stp)
 	/*
 	 * Check to see if the file exists on the remote machine.
 	 */
-	(void) snprintf(buf, BUFSIZ, "Q%s\n", rname);
+	(void) snprintf(buf, sizeof(buf), "Q%s\n", rname);
 	if (debug)
 		printf("buf = %s", buf);
 	(void) write(rem, buf, strlen(buf));
@@ -661,7 +666,8 @@ query(name)
 	struct stat stb;
 
 	if (catname)
-		(void) sprintf(tp, "/%s", name);
+		(void) snprintf(tp, sizeof(target) - (tp - target),
+			"/%s", name);
 
 	if (lstat(target, &stb) < 0) {
 		if (errno == ENOENT)
@@ -674,8 +680,8 @@ query(name)
 
 	switch (stb.st_mode & S_IFMT) {
 	case S_IFREG:
-		(void) snprintf(buf, BUFSIZ, "Y%qd %ld\n", stb.st_size,
-		    stb.st_mtime);
+		(void) snprintf(buf, sizeof(buf), "Y%qd %ld\n", stb.st_size,
+			stb.st_mtime);
 		(void) write(rem, buf, strlen(buf));
 		break;
 
@@ -706,9 +712,6 @@ recvf(cmd, type)
 	char new[BUFSIZ];
 	extern char *tempname;
 
-	cp = cmd;
-	opts = 0;
-	f = 0;		/*  Initialize, so for links it remains 0.  */
 	while (*cp >= '0' && *cp <= '7')
 		opts = (opts << 3) | (*cp++ - '0');
 	if (*cp++ != ' ') {
@@ -777,7 +780,7 @@ recvf(cmd, type)
 					return;
 				}
 				buf[0] = '\0';
-				(void) snprintf(buf + 1, BUFSIZ - 1,
+				(void) snprintf(buf + 1, sizeof(buf) - 1,
 					"%s: Warning: remote mode %o != local mode %o\n",
 					target, stb.st_mode & 07777, mode);
 				(void) write(rem, buf, strlen(buf + 1) + 1);
@@ -797,7 +800,7 @@ recvf(cmd, type)
 	}
 
 	if (catname)
-		(void) sprintf(tp, "/%s", cp);
+		(void) snprintf(tp, sizeof(target) - (tp - target), "/%s", cp);
 	cp = strrchr(target, '/');
 	if (cp == NULL)
 		strcpy(new, tempname);
@@ -905,7 +908,7 @@ badnew1:		error("%s:%s: %s\n", host, new, strerror(errno));
 		(void) fclose(f2);
 		if (opts & VERIFY) {
 differ:			buf[0] = '\0';
-			(void) snprintf(buf + 1, BUFSIZ - 1,
+			(void) snprintf(buf + 1, sizeof(buf) - 1,
 				"need to update: %s\n",target);
 			(void) write(rem, buf, strlen(buf + 1) + 1);
 			goto badnew2;
@@ -924,7 +927,7 @@ differ:			buf[0] = '\0';
 
 	if (fchog(f, new, owner, group, mode) < 0) {
 badnew2:	
-		if (f == -1)
+		if (f >= 0)
 			(void) close(f);
 		(void) unlink(new);
 		return;
@@ -939,7 +942,7 @@ badtarget:	error("%s:%s: %s\n", host, target, strerror(errno));
 
 	if (opts & COMPARE) {
 		buf[0] = '\0';
-		(void) snprintf(buf + 1, BUFSIZ - 1,
+		(void) snprintf(buf + 1, sizeof(buf) - 1,
 			"updated %s\n", target);
 		(void) write(rem, buf, strlen(buf + 1) + 1);
 	} else
@@ -953,10 +956,10 @@ static void
 hardlink(cmd)
 	char *cmd;
 {
-	register char *cp;
+	register char *cp = cmd;
 	struct stat stb;
 	char *oldname;
-	int opts, exists = 0;
+	int opts = 0, exists = 0;
 
 	while (*cp >= '0' && *cp <= '7')
 		opts = (opts << 3) | (*cp++ - '0');
@@ -974,7 +977,7 @@ hardlink(cmd)
 	*cp++ = '\0';
 
 	if (catname) {
-		(void) sprintf(tp, "/%s", cp);
+		(void) snprintf(tp, sizeof(target) - (tp - target), "/%s", cp);
 	}
 	if (lstat(target, &stb) == 0) {
 		int mode = stb.st_mode & S_IFMT;
@@ -1110,7 +1113,7 @@ rmchk(opts)
 	/*
 	 * Tell the remote to clean the files from the last directory sent.
 	 */
-	(void) snprintf(buf, BUFSIZ, "C%o\n", opts & VERIFY);
+	(void) snprintf(buf, sizeof(buf), "C%o\n", opts & VERIFY);
 	if (debug)
 		printf("buf = %s", buf);
 	(void) write(rem, buf, strlen(buf));
@@ -1131,7 +1134,8 @@ rmchk(opts)
 			 * Y\n -- file doesn't exist - REMOVE.
 			 */
 			*--cp = '\0';
-			(void) sprintf(tp, "/%s", s);
+			(void) snprintf(tp, sizeof(target) - (tp - target),
+				"/%s", s);
 			if (debug)
 				printf("check %s\n", target);
 			if (except(target))
@@ -1222,7 +1226,7 @@ clean(cp)
 			error("%s:%s: %s\n", host, target, strerror(errno));
 			continue;
 		}
-		(void) snprintf(buf, BUFSIZ, "Q%s\n", dp->d_name);
+		(void) snprintf(buf, sizeof(buf), "Q%s\n", dp->d_name);
 		(void) write(rem, buf, strlen(buf));
 		cp = buf;
 		do {
@@ -1236,7 +1240,7 @@ clean(cp)
 		if (opts & VERIFY) {
 			cp = buf;
 			*cp++ = '\0';
-			(void) snprintf(cp, BUFSIZ - 1,
+			(void) snprintf(cp, sizeof(buf) - 1,
 				"need to remove: %s\n", target);
 			(void) write(rem, buf, strlen(cp) + 1);
 		} else
@@ -1315,7 +1319,7 @@ bad:
 removed:
 	cp = buf;
 	*cp++ = '\0';
-	(void) snprintf(cp, BUFSIZ - 1, "removed %s\n", target);
+	(void) snprintf(cp, sizeof(buf) - 1, "removed %s\n", target);
 	(void) write(rem, buf, strlen(cp) + 1);
 }
 
@@ -1357,7 +1361,7 @@ dospecial(cmd)
 	(void) close(fd[1]);
 	s = sbuf;
 	*s++ = '\0';
-	while ((i = read(fd[0], buf, BUFSIZ)) > 0) {
+	while ((i = read(fd[0], buf, sizeof(buf))) > 0) {
 		cp = buf;
 		do {
 			*s++ = *cp++;
@@ -1577,7 +1581,7 @@ note(fmt, va_alist)
 #else
 	va_start(ap);
 #endif
-	(void) vsnprintf(buf, BUFSIZ, fmt, ap);
+	(void) vsnprintf(buf, sizeof(buf), fmt, ap);
 	va_end(ap);
 	comment(buf);
 }