warnx?/errx? paranoia (use "%s" not a bare string unless it is a

constant).  These are not security holes but it is worth fixing
them anyway both for robustness and so folks looking for examples
in the tree are not misled into doing something potentially dangerous.
Furthermore, it is a bad idea to assume that pathnames will not
include '%' in them and that error routines don't return strings
with '%' in them (especially in light of the possibility of locales).

3 files changed, 13 insertions, 13 deletions

diff --git a/games/monop/cards.c b/games/monop/cards.c
index 2de4a31bed5..5e3702371aa 100644
--- a/games/monop/cards.c
+++ b/games/monop/cards.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: cards.c,v 1.3 1998/09/20 23:36:50 pjanzen Exp $	*/
+/*	$OpenBSD: cards.c,v 1.4 2000/06/30 16:00:04 millert Exp $	*/
 /*	$NetBSD: cards.c,v 1.3 1995/03/23 08:34:35 cgd Exp $	*/
 
 /*
@@ -38,7 +38,7 @@
 #if 0
 static char sccsid[] = "@(#)cards.c	8.1 (Berkeley) 5/31/93";
 #else
-static char rcsid[] = "$OpenBSD: cards.c,v 1.3 1998/09/20 23:36:50 pjanzen Exp $";
+static char rcsid[] = "$OpenBSD: cards.c,v 1.4 2000/06/30 16:00:04 millert Exp $";
 #endif
 #endif /* not lint */
 
@@ -72,7 +72,7 @@ init_decks()
 {
 	if ((deckf = fopen(cardfile, "r")) == NULL)
 file_err:
-		err(1, cardfile);
+		err(1, "%s", cardfile);
 	if (fread(&deck[0].num_cards, sizeof(deck[0].num_cards), 1, deckf) != 1)
 		goto file_err;
 	if (fread(&deck[0].last_card, sizeof(deck[0].last_card), 1, deckf) != 1)
@@ -108,7 +108,7 @@ set_up(dp)
 		errx(1, "malloc");
 	for (i = 0 ; i < dp->num_cards ; i++) {
 		if (fread(&dp->offsets[i], sizeof(dp->offsets[i]), 1, deckf) != 1)
-			err(1, cardfile);
+			err(1, "%s", cardfile);
 		dp->offsets[i] = ntohl(dp->offsets[i]);
 	}
 	dp->last_card = 0;
diff --git a/games/monop/execute.c b/games/monop/execute.c
index 770942efa0e..9e9b5e332f2 100644
--- a/games/monop/execute.c
+++ b/games/monop/execute.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: execute.c,v 1.3 1998/11/29 19:45:11 pjanzen Exp $	*/
+/*	$OpenBSD: execute.c,v 1.4 2000/06/30 16:00:04 millert Exp $	*/
 /*	$NetBSD: execute.c,v 1.3 1995/03/23 08:34:38 cgd Exp $	*/
 
 /*
@@ -38,7 +38,7 @@
 #if 0
 static char sccsid[] = "@(#)execute.c	8.1 (Berkeley) 5/31/93";
 #else
-static char rcsid[] = "$OpenBSD: execute.c,v 1.3 1998/11/29 19:45:11 pjanzen Exp $";
+static char rcsid[] = "$OpenBSD: execute.c,v 1.4 2000/06/30 16:00:04 millert Exp $";
 #endif
 #endif /* not lint */
 
@@ -220,7 +220,7 @@ save()
 		return;
 
 	if ((outf=creat(buf, 0644)) < 0) {
-		warn(buf);
+		warn("%s", buf);
 		return;
 	}
 	printf("\"%s\" ", buf);
@@ -267,12 +267,12 @@ rest_f(file)
 	STAT	sbuf;
 
 	if ((inf = open(file, O_RDONLY)) < 0) {
-		warn(file);
+		warn("%s", file);
 		return FALSE;
 	}
 	printf("\"%s\" ", file);
 	if (fstat(inf, &sbuf) < 0)		/* get file stats	*/
-		err(1, file);
+		err(1, "%s", file);
 #if 0
 	start = (((int) etext + (SEGSIZE-1)) / SEGSIZE ) * SEGSIZE;
 #else
diff --git a/games/monop/initdeck.c b/games/monop/initdeck.c
index 1f712d86f7d..0201660691f 100644
--- a/games/monop/initdeck.c
+++ b/games/monop/initdeck.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: initdeck.c,v 1.6 1998/09/20 23:36:51 pjanzen Exp $	*/
+/*	$OpenBSD: initdeck.c,v 1.7 2000/06/30 16:00:04 millert Exp $	*/
 /*	$NetBSD: initdeck.c,v 1.3 1995/03/23 08:34:43 cgd Exp $	*/
 
 /*
@@ -44,7 +44,7 @@ static char copyright[] =
 #if 0
 static char sccsid[] = "@(#)initdeck.c	8.1 (Berkeley) 5/31/93";
 #else
-static char rcsid[] = "$OpenBSD: initdeck.c,v 1.6 1998/09/20 23:36:51 pjanzen Exp $";
+static char rcsid[] = "$OpenBSD: initdeck.c,v 1.7 2000/06/30 16:00:04 millert Exp $";
 #endif
 #endif /* not lint */
 
@@ -94,7 +94,7 @@ main(ac, av)
 
 	getargs(ac, av);
 	if ((inf = fopen(infile, "r")) == NULL)
-		err(1, infile);
+		err(1, "%s", infile);
 	count();
 	/*
 	 * allocate space for pointers.
@@ -106,7 +106,7 @@ main(ac, av)
 		errx(1, "malloc");
 	fseek(inf, 0L, 0);
 	if ((outf = fopen(outfile, "w")) == NULL)
-		err(1, outfile);
+		err(1, "%s", outfile);
 
 	fwrite(&deck[0].num_cards, sizeof(deck[0].num_cards), 1, outf);
 	fwrite(&deck[0].last_card, sizeof(deck[0].last_card), 1, outf);