snprintf & strlcpy; tedu ok

6 files changed, 25 insertions, 22 deletions

diff --git a/usr.bin/awk/lib.c b/usr.bin/awk/lib.c
index 27c6175232c..790b4f526d4 100644
--- a/usr.bin/awk/lib.c
+++ b/usr.bin/awk/lib.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: lib.c,v 1.11 2002/12/19 21:24:28 millert Exp $	*/
+/*	$OpenBSD: lib.c,v 1.12 2003/04/04 00:42:34 deraadt Exp $	*/
 /****************************************************************
 Copyright (C) Lucent Technologies 1997
 All Rights Reserved
@@ -84,7 +84,7 @@ void makefields(int n1, int n2)		/* create $n1..$n2 inclusive */
 		if (fldtab[i] == NULL)
 			FATAL("out of space in makefields %d", i);
 		*fldtab[i] = dollar1;
-		sprintf(temp, "%d", i);
+		snprintf(temp, sizeof temp, "%d", i);
 		fldtab[i]->nval = tostring(temp);
 	}
 }
@@ -189,7 +189,7 @@ int readrec(char **pbuf, int *pbufsize, FILE *inf)	/* read one record into buf *
 
 	if (strlen(*FS) >= sizeof(inputFS))
 		FATAL("field separator %.10s... is too long", *FS);
-	strcpy(inputFS, *FS);	/* for subsequent field splitting */
+	strlcpy(inputFS, *FS, sizeof inputFS);	/* for subsequent field splitting */
 	if ((sep = **RS) == 0) {
 		sep = '\n';
 		while ((c=getc(inf)) == '\n' && c != EOF)	/* skip leading \n's */
@@ -228,7 +228,7 @@ char *getargv(int n)	/* get ARGV[n] */
 	char *s, temp[50];
 	extern Array *ARGVtab;
 
-	sprintf(temp, "%d", n);
+	snprintf(temp, sizeof temp, "%d", n);
 	x = setsymtab(temp, "", 0.0, STR, ARGVtab);
 	s = getsval(x);
 	   dprintf( ("getargv(%d) returns |%s|\n", n, s) );
diff --git a/usr.bin/awk/maketab.c b/usr.bin/awk/maketab.c
index 5213164e886..e09410d3d68 100644
--- a/usr.bin/awk/maketab.c
+++ b/usr.bin/awk/maketab.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: maketab.c,v 1.6 2002/12/19 21:24:28 millert Exp $	*/
+/*	$OpenBSD: maketab.c,v 1.7 2003/04/04 00:42:34 deraadt Exp $	*/
 /****************************************************************
 Copyright (C) Lucent Technologies 1997
 All Rights Reserved
@@ -164,7 +164,7 @@ int main(int argc, char *argv[])
 	printf("{\n");
 	printf("	static char buf[100];\n\n");
 	printf("	if (n < FIRSTTOKEN || n > LASTTOKEN) {\n");
-	printf("		sprintf(buf, \"token %%d\", n);\n");
+	printf("		snprintf(buf, sizeof buf, \"token %%d\", n);\n");
 	printf("		return buf;\n");
 	printf("	}\n");
 	printf("	return printname[n-FIRSTTOKEN];\n");
diff --git a/usr.bin/awk/run.c b/usr.bin/awk/run.c
index 4e582664e78..abbf3d3717b 100644
--- a/usr.bin/awk/run.c
+++ b/usr.bin/awk/run.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: run.c,v 1.18 2002/12/19 21:24:28 millert Exp $	*/
+/*	$OpenBSD: run.c,v 1.19 2003/04/04 00:42:34 deraadt Exp $	*/
 /****************************************************************
 Copyright (C) Lucent Technologies 1997
 All Rights Reserved
@@ -1234,7 +1234,7 @@ Cell *split(Node **a, int nnn)	/* split(a[0], a[1], a[2]); a[3] is type */
 			pfa->initstat = 2;
 			do {
 				n++;
-				sprintf(num, "%d", n);
+				snprintf(num, sizeof num, "%d", n);
 				temp = *patbeg;
 				*patbeg = '\0';
 				if (is_number(s))
@@ -1245,7 +1245,7 @@ Cell *split(Node **a, int nnn)	/* split(a[0], a[1], a[2]); a[3] is type */
 				s = patbeg + patlen;
 				if (*(patbeg+patlen-1) == 0 || *s == 0) {
 					n++;
-					sprintf(num, "%d", n);
+					snprintf(num, sizeof num, "%d", n);
 					setsymtab(num, "", 0.0, STR, (Array *) ap->sval);
 					pfa->initstat = tempstat;
 					goto spdone;
@@ -1253,7 +1253,7 @@ Cell *split(Node **a, int nnn)	/* split(a[0], a[1], a[2]); a[3] is type */
 			} while (nematch(pfa,s));
 		}
 		n++;
-		sprintf(num, "%d", n);
+		snprintf(num, sizeof num, "%d", n);
 		if (is_number(s))
 			setsymtab(num, s, atof(s), STR|NUM, (Array *) ap->sval);
 		else
@@ -1273,7 +1273,7 @@ Cell *split(Node **a, int nnn)	/* split(a[0], a[1], a[2]); a[3] is type */
 			while (*s!=' ' && *s!='\t' && *s!='\n' && *s!='\0');
 			temp = *s;
 			*s = '\0';
-			sprintf(num, "%d", n);
+			snprintf(num, sizeof num, "%d", n);
 			if (is_number(t))
 				setsymtab(num, t, atof(t), STR|NUM, (Array *) ap->sval);
 			else
@@ -1286,7 +1286,7 @@ Cell *split(Node **a, int nnn)	/* split(a[0], a[1], a[2]); a[3] is type */
 		for (n = 0; *s != 0; s++) {
 			char buf[2];
 			n++;
-			sprintf(num, "%d", n);
+			snprintf(num, sizeof num, "%d", n);
 			buf[0] = *s;
 			buf[1] = 0;
 			if (isdigit((uschar)buf[0]))
@@ -1302,7 +1302,7 @@ Cell *split(Node **a, int nnn)	/* split(a[0], a[1], a[2]); a[3] is type */
 				s++;
 			temp = *s;
 			*s = '\0';
-			sprintf(num, "%d", n);
+			snprintf(num, sizeof num, "%d", n);
 			if (is_number(t))
 				setsymtab(num, t, atof(t), STR|NUM, (Array *) ap->sval);
 			else
diff --git a/usr.bin/awk/tran.c b/usr.bin/awk/tran.c
index 71dd01356ff..f7f8440b503 100644
--- a/usr.bin/awk/tran.c
+++ b/usr.bin/awk/tran.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: tran.c,v 1.8 2002/12/19 21:24:28 millert Exp $	*/
+/*	$OpenBSD: tran.c,v 1.9 2003/04/04 00:42:34 deraadt Exp $	*/
 /****************************************************************
 Copyright (C) Lucent Technologies 1997
 All Rights Reserved
@@ -107,7 +107,7 @@ void arginit(int ac, char **av)	/* set up ARGV and ARGC */
 	ARGVtab = makesymtab(NSYMTAB);	/* could be (int) ARGC as well */
 	cp->sval = (char *) ARGVtab;
 	for (i = 0; i < ac; i++) {
-		sprintf(temp, "%d", i);
+		snprintf(temp, sizeof temp, "%d", i);
 		if (is_number(*av))
 			setsymtab(temp, *av, atof(*av), STR|NUM, ARGVtab);
 		else
diff --git a/usr.bin/sectok/cmds.c b/usr.bin/sectok/cmds.c
index 99e691bc371..fd3e709c22b 100644
--- a/usr.bin/sectok/cmds.c
+++ b/usr.bin/sectok/cmds.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: cmds.c,v 1.20 2002/06/17 07:10:52 deraadt Exp $ */
+/*	$OpenBSD: cmds.c,v 1.21 2003/04/04 00:42:34 deraadt Exp $ */
 
 /*
  * Smartcard commander.
@@ -580,6 +580,7 @@ chpin(int argc, char *argv[])
 {
 	int     keyno = 1, i, sw;
 	char    pin[255];
+	char	*pass;
 
 	optind = optreset = 1;
 
@@ -591,8 +592,10 @@ chpin(int argc, char *argv[])
 		}
 	}
 
-	strcpy(pin, getpass("Enter Old PIN: "));
-	strcat(pin, getpass("Enter New PIN: "));
+	pass = getpass("Enter Old PIN: ");
+	strlcpy(pin, pass, sizeof pin);
+	pass = getpass("Enter New PIN: ");
+	strlcat(pin, pass, sizeof pin);
 
 	sectok_apdu(fd, cla, 0x24, 0, keyno, strlen(pin), pin, 0, NULL, &sw);
 	bzero(pin, strlen(pin));
diff --git a/usr.bin/which/which.c b/usr.bin/which/which.c
index fef3eb6b0b5..1d4dac5fc86 100644
--- a/usr.bin/which/which.c
+++ b/usr.bin/which/which.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: which.c,v 1.6 2002/02/16 21:27:59 millert Exp $	*/
+/*	$OpenBSD: which.c,v 1.7 2003/04/04 00:42:34 deraadt Exp $	*/
 
 /*
  * Copyright (c) 1997 Todd C. Miller <Todd.Miller@courtesan.com>
@@ -28,7 +28,7 @@
  */
 
 #ifndef lint                                                              
-static char rcsid[] = "$OpenBSD: which.c,v 1.6 2002/02/16 21:27:59 millert Exp $";
+static char rcsid[] = "$OpenBSD: which.c,v 1.7 2003/04/04 00:42:34 deraadt Exp $";
 #endif /* not lint */                                                        
 
 #include <sys/param.h>
@@ -162,9 +162,9 @@ findprog(prog, path, progmode, allmatches)
 			return(0);
 		}
 
-		(void)strcpy(filename, p);
+		(void)strlcpy(filename, p, sizeof filename);
 		filename[plen] = '/';
-		(void)strcpy(filename + plen + 1, prog);
+		(void)strlcpy(filename + plen + 1, prog, sizeof filename - (plen + 1));
 		if ((stat(filename, &sbuf) == 0) && S_ISREG(sbuf.st_mode) &&
 		    access(filename, X_OK) == 0) {
 			(void)puts(filename);