strcpy/strcat/sprintf cleanups; ok krw deraadt

20 files changed, 46 insertions, 47 deletions

diff --git a/usr.sbin/afs/src/appl/bos/bos_status.c b/usr.sbin/afs/src/appl/bos/bos_status.c
index f291c4dda42..b9e99bef297 100644
--- a/usr.sbin/afs/src/appl/bos/bos_status.c
+++ b/usr.sbin/afs/src/appl/bos/bos_status.c
@@ -106,7 +106,8 @@ printstatus(const char *cell,
 	error = BOZO_EnumerateInstance(conn, i, instance_name);
 	if (error == 0) {
 	    error = BOZO_GetStatus(conn, instance_name,
-				   &getstatus_int, getstatus_str);
+				   &getstatus_int, getstatus_str,
+				   sizeof(getstatus_str));
 	    if (error == -1) {
 		warnx ("failed to contact host's bosserver (%s) "
 		       "(communications failure (-1)).", 
diff --git a/usr.sbin/afs/src/appl/fs/fs.c b/usr.sbin/afs/src/appl/fs/fs.c
index dfb05459cb5..1366fd2c8be 100644
--- a/usr.sbin/afs/src/appl/fs/fs.c
+++ b/usr.sbin/afs/src/appl/fs/fs.c
@@ -1712,18 +1712,18 @@ afs_copyacl(char *fromdir, char *todir)
     if((acl=afs_getacl(fromdir))==NULL)
 	exit(1);
 
-    sprintf(acltext,"%d\n%d\n", acl->NumPositiveEntries,
+    snprintf(acltext, sizeof(acltext), "%d\n%d\n", acl->NumPositiveEntries,
 	    acl->NumNegativeEntries);
     position=acl->pos;
     for(i=0; i<acl->NumPositiveEntries; i++) {
-	sprintf(tmpstr, "%s %d\n", position->name, position->RightsMask);
-	strcat(acltext,tmpstr);
+	snprintf(tmpstr, sizeof(tmpstr), "%s %d\n", position->name, position->RightsMask);
+	strlcat(acltext, tmpstr, sizeof(acltext));
 	position=position->next;
     }
     position=acl->neg;
     for(i=0; i<acl->NumNegativeEntries; i++) {
 	sprintf(tmpstr, "%s %d\n", position->name, position->RightsMask);
-	strcat(acltext,tmpstr);
+	strlcat(acltext, tmpstr, sizeof(acltext));
 	position=position->next;
     }
 
@@ -1886,7 +1886,7 @@ afs_setacl(char *path, char *user, char *rights)
 	position = position->next) {
 	if (position->RightsMask) {
 	    sprintf(tmpstr, "%s %d\n", position->name, position->RightsMask);
-	    strcat(acltext,tmpstr);
+	    strlcat(acltext, tmpstr, sizeof(acltext));
 	} else
 	    acl->NumPositiveEntries--;
     }
@@ -1895,7 +1895,7 @@ afs_setacl(char *path, char *user, char *rights)
 	position = position->next) {
 	if (position->RightsMask) {
 	    sprintf(tmpstr, "%s %d\n", position->name, position->RightsMask);
-	    strcat(acltext,tmpstr);
+	    strlcat(acltext, tmpstr, sizeof(acltext));
 	} else
 	    acl->NumNegativeEntries--;
     }
diff --git a/usr.sbin/afs/src/appl/pts/pts.c b/usr.sbin/afs/src/appl/pts/pts.c
index ccab7ed9378..0ac8eeb8151 100644
--- a/usr.sbin/afs/src/appl/pts/pts.c
+++ b/usr.sbin/afs/src/appl/pts/pts.c
@@ -159,9 +159,9 @@ dump_cmd (int argc, char **argv)
 }
 
 static int
-flags_to_string(int flags, char *string)
+flags_to_string(int flags, char *string, size_t size)
 {
-    strcpy(string, "-----");
+    strlcpy(string, "-----", size);
     if((flags & PRP_STATUS_ANY) != 0)
 	string[0]='S';
     else if((flags & PRP_STATUS_MEM) != 0)
@@ -218,7 +218,7 @@ examine_id(struct rx_connection *conn, int32_t id, char *idname)
       return error;
     } 
 
-    flags_to_string(ent.flags << 16, flags_str); /* XXX why do i have to shift by 16? seems strange */
+    flags_to_string(ent.flags << 16, flags_str, sizeof(flags_str)); /* XXX why do i have to shift by 16? seems strange */
 
     printf("Name: %s, id: %d, owner: %s, creator: %s,\n", 
            nlist.val[0], ent.id, nlist.val[1], nlist.val[2]);
diff --git a/usr.sbin/afs/src/appl/vos/vos_backup.c b/usr.sbin/afs/src/appl/vos/vos_backup.c
index 98c242bc5dc..6821456ba61 100644
--- a/usr.sbin/afs/src/appl/vos/vos_backup.c
+++ b/usr.sbin/afs/src/appl/vos/vos_backup.c
@@ -106,13 +106,11 @@ backup_volume (const char *volume,
     if (backexists) {
 	error = VOLSER_AFSVolReClone(conn_volser, trans_id_rw, newVol);
     } else {
-	newname = malloc(strlen(the_vlentry.name)+8);
-	if(newname == NULL) {
-	    fprintf (stderr, "backup volume: malloc failed: %s\n",
+	if (asprintf(&newname, "%s.backup", the_vlentry.name) == -1) {
+	    fprintf (stderr, "backup volume: asprintf failed: %s\n",
 		     strerror(errno));
 	    goto out;
 	}
-	sprintf(newname, "%s.backup", the_vlentry.name);
 
 	error = VOLSER_AFSVolClone(conn_volser,
 				   trans_id_rw,
diff --git a/usr.sbin/afs/src/arlad/arla-cli.c b/usr.sbin/afs/src/arlad/arla-cli.c
index 9fd212f31b8..cca16cbf828 100644
--- a/usr.sbin/afs/src/arlad/arla-cli.c
+++ b/usr.sbin/afs/src/arlad/arla-cli.c
@@ -178,8 +178,8 @@ walk (VenusFid *startdir, char *fname)
 	      * the expansion of the symlink and append fname to it.
 	      */
 	     if (fname != NULL) {
-		 strcat (symlink, "/");
-		 strcat (symlink, fname);
+		 strlcat(symlink, "/", sizeof(symlink));
+		 strlcat(symlink, fname, sizeof(symlink));
 	     }
 	     strlcpy(store_name, symlink, sizeof(store_name));
 	     fname = store_name;
diff --git a/usr.sbin/afs/src/arlad/reconnect.c b/usr.sbin/afs/src/arlad/reconnect.c
index 56476fc23a2..f60b6ee1ab5 100644
--- a/usr.sbin/afs/src/arlad/reconnect.c
+++ b/usr.sbin/afs/src/arlad/reconnect.c
@@ -489,7 +489,7 @@ keepfid_newrename(char *name,
         fid_KP_head = (fid_keep *)malloc(sizeof(fid_keep));
         assert(fid_KP_head);
 
-        strcpy(fid_KP_head->name, name);
+        strlcpy(fid_KP_head->name, name, sizeof(fid_KP_head->name));
 	fid_KP_head->kept_fid = fid;
 	fid_KP_head->next = 0;
     }
@@ -499,8 +499,7 @@ keepfid_newrename(char *name,
         temp = (fid_keep *)malloc(sizeof(fid_keep));
 	assert(temp);
 
-        strcpy(temp->name, name);
-	temp->name[strlen(name)] = '\0';
+        strlcpy(temp->name, name, sizeof(temp->name));
 	temp->kept_fid = fid;
 	temp->next = fid_KP_head->next;
 	fid_KP_head->next = temp;
@@ -1044,8 +1043,7 @@ fcache_backfile_name(char *name, size_t len)
     static int no = 1;
 
     snprintf (name, len, "%04X",no++);
-    strcat (name, "bak");
-    name[strlen(name)+1] = '\0';
+    strlcat (name, "bak", len);
 }
 
 /*
diff --git a/usr.sbin/afs/src/include/bits.c b/usr.sbin/afs/src/include/bits.c
index df07fc5eae2..99a07418986 100644
--- a/usr.sbin/afs/src/include/bits.c
+++ b/usr.sbin/afs/src/include/bits.c
@@ -65,8 +65,8 @@ strupr(char *s)
     while(x){ x <<= 1; b++; if(x < zero) pre=""; }		\
     if(b >= len){						\
         int tabs;						\
-	sprintf(tmp, "%sint%d_t" , pre, len);			\
-	sprintf(tmp2, "typedef %s %s;", #TYPE, tmp);		\
+	snprintf(tmp, sizeof(tmp), "%sint%d_t" , pre, len);	\
+	snprintf(tmp2, sizeof(tmp2), "typedef %s %s;", #TYPE, tmp);	\
 	strupr(tmp);						\
 	tabs = 5 - strlen(tmp2) / 8;				\
         fprintf(f, "%s", tmp2);					\
@@ -131,8 +131,7 @@ int main(int argc, char **argv)
     } else {
 	char *p;
 	fn = argv[1];
-	hb = malloc(strlen(fn) + 5);
-	sprintf(hb, "__%s__", fn);
+	asprintf(&hb, "__%s__", fn);
 	for(p = hb; *p; p++){
 	    if(!isalnum((int)*p))
 		*p = '_';
diff --git a/usr.sbin/afs/src/lib/bufdir/fdir.c b/usr.sbin/afs/src/lib/bufdir/fdir.c
index b64919f13d1..74f4634d6b1 100644
--- a/usr.sbin/afs/src/lib/bufdir/fdir.c
+++ b/usr.sbin/afs/src/lib/bufdir/fdir.c
@@ -287,7 +287,7 @@ add_to_page (DirPage0 *page0,
 	    page->entry[i].next = next;
 	    page->entry[i].fid.Vnode  = htonl(fid.Vnode);
 	    page->entry[i].fid.Unique = htonl(fid.Unique);
-	    strcpy (page->entry[i].name, filename);
+	    strlcpy (page->entry[i].name, filename, sizeof(page->entry[i].name));
 	    memset(page->entry[i + j - 1].fill, 0, 4);
 	    if (pageno < MAXPAGES)
 		page0->dheader.map[pageno] -= n;
diff --git a/usr.sbin/afs/src/lib/ko/gensysname.c b/usr.sbin/afs/src/lib/ko/gensysname.c
index e32be515fc6..676c9dac2fc 100644
--- a/usr.sbin/afs/src/lib/ko/gensysname.c
+++ b/usr.sbin/afs/src/lib/ko/gensysname.c
@@ -109,7 +109,7 @@ bsd_gen_sysname(char *buf,
     const char *name;
     if(uname(&uts) < 0) {
 	warn("uname");
-	strcpy(buf, "bsdhost");
+	strlcpy(buf, "bsdhost", len);
 	return;
     }
     if(strcmp(uts.sysname, "FreeBSD") == 0)
diff --git a/usr.sbin/afs/src/lib/ko/vlmisc.c b/usr.sbin/afs/src/lib/ko/vlmisc.c
index 9a35eada45a..8090f6f3b2c 100644
--- a/usr.sbin/afs/src/lib/ko/vlmisc.c
+++ b/usr.sbin/afs/src/lib/ko/vlmisc.c
@@ -65,7 +65,7 @@ void
 volintInfo2xvolintInfo (const volintInfo *old, xvolintInfo *new)
 {
     memset (new, 0, sizeof(*new));
-    strcpy (new->name, old->name);
+    strlcpy (new->name, old->name, sizeof(new->name));
     new->volid		= old->volid;
     new->type		= old->type;
     new->backupID	= old->backupID;
diff --git a/usr.sbin/afs/src/lib/sl/ss.c b/usr.sbin/afs/src/lib/sl/ss.c
index a4d9e8b8af5..573735af4b4 100644
--- a/usr.sbin/afs/src/lib/sl/ss.c
+++ b/usr.sbin/afs/src/lib/sl/ss.c
@@ -112,12 +112,11 @@ ss_execute_line (int index, const char *line)
 int
 ss_listen (int index)
 {
-    char *prompt = malloc(strlen(subsystems[index].name) + 3);
-    if(prompt == NULL) {
+    char *prompt;
+
+    if (asprintf(&prompt, "%s: ", subsystems[index].name) == -1) {
 	abort();
     }
-    strcpy(prompt, subsystems[index].name);
-    strcat(prompt, ": ");
     sl_loop(subsystems[index].table, prompt);
     free(prompt);
     return 0;
diff --git a/usr.sbin/afs/src/lwp/rw.c b/usr.sbin/afs/src/lwp/rw.c
index ab0141cbb41..63d318d5b37 100644
--- a/usr.sbin/afs/src/lwp/rw.c
+++ b/usr.sbin/afs/src/lwp/rw.c
@@ -237,7 +237,7 @@ main(int argc, char **argv)
     printf("[Creating Readers...\n");
     readers = (PROCESS *) calloc(nreaders, sizeof(PROCESS));
     for (i=0; i<nreaders; i++) {
-        sprintf(rname, "Reader %d", i);
+        snprintf(rname, sizeof(rname), "Reader %d", i);
 	LWP_CreateProcess((void (*)())(read_process),
 			  STACK_SIZE, 0, (char *)i, rname, &readers[i]);
     }
diff --git a/usr.sbin/afs/src/milko/bos/bosprocs.c b/usr.sbin/afs/src/milko/bos/bosprocs.c
index 16904c421d7..4ea6b1968cb 100644
--- a/usr.sbin/afs/src/milko/bos/bosprocs.c
+++ b/usr.sbin/afs/src/milko/bos/bosprocs.c
@@ -80,11 +80,12 @@ int
 BOZO_GetStatus(struct rx_call *call,
 	       const char *instance,
 	       int32_t *inStat,
-	       char *statdescr)
+	       char *statdescr,
+	       size_t statdescrlen)
 {
     bosdebug ("BOZO_GetStatus: %s\n", instance);
 
-    strcpy (statdescr, "foo");
+    strlcpy (statdescr, "foo", statdescrlen);
     *inStat = 0;
     return 0;
 }
diff --git a/usr.sbin/afs/src/rx/rx_trace.c b/usr.sbin/afs/src/rx/rx_trace.c
index a7bbe346c67..64361004370 100644
--- a/usr.sbin/afs/src/rx/rx_trace.c
+++ b/usr.sbin/afs/src/rx/rx_trace.c
@@ -116,7 +116,7 @@ main(int argc, char **argv)
     argc--;
     while (argc && **argv == '-') {
 	if (strcmp(*argv, "-trace") == 0) {
-	    strcpy(rxi_tracename, *(++argv));
+	    strlcpy(rxi_tracename, *(++argv), sizeof(rxi_tracename));
 	    argc--;
 	} else {
 	    err++;
diff --git a/usr.sbin/afs/src/rx/rxperf.c b/usr.sbin/afs/src/rx/rxperf.c
index 2099543525f..ec10fc2ace1 100644
--- a/usr.sbin/afs/src/rx/rxperf.c
+++ b/usr.sbin/afs/src/rx/rxperf.c
@@ -330,7 +330,7 @@ do_client (const char *server, int port, int32_t bytes)
     if (rx_Write (call, &data, 4) != 4)
 	errx (1, "rx_Write failed to send command");
 
-    sprintf (stamp, "send       %d bytes", bytes);
+    snprintf (stamp, sizeof(stamp), "send       %d bytes", bytes);
     start_timer();
     
     data = htonl (bytes);
diff --git a/usr.sbin/afs/src/rxdef/bos.xg b/usr.sbin/afs/src/rxdef/bos.xg
index 87575b81337..d718fd06f28 100644
--- a/usr.sbin/afs/src/rxdef/bos.xg
+++ b/usr.sbin/afs/src/rxdef/bos.xg
@@ -152,7 +152,8 @@ SetStatus (IN string instance<BOZO_BSSIZE>) = 82;
 
 GetStatus (IN string instance<BOZO_BSSIZE>,
 	   OUT long *inStat,
-	   OUT string statdescr<BOZO_BSSIZE>) = 83;
+	   OUT string statdescr<BOZO_BSSIZE>,
+	   IN unsigned long size) = 83;
 
 
 EnumerateInstance (IN long instance,
diff --git a/usr.sbin/afs/src/rxkad/rxk_crpt.c b/usr.sbin/afs/src/rxkad/rxk_crpt.c
index 263925aeda2..0c19e3405a8 100644
--- a/usr.sbin/afs/src/rxkad/rxk_crpt.c
+++ b/usr.sbin/afs/src/rxkad/rxk_crpt.c
@@ -727,7 +727,7 @@ main()
    */
   fc_keysched(key1, sched);
   memcpy(iv, key2, sizeof(iv));
-  strcpy(clear, the_quick);
+  strlcpy(clear, the_quick, sizeof(clear));
   packet.wirevec[1].iov_base = clear;
   packet.wirevec[1].iov_len = sizeof(the_quick);
   packet.wirevec[2].iov_len = 0;
diff --git a/usr.sbin/afs/src/tests/large-dir.c b/usr.sbin/afs/src/tests/large-dir.c
index 174410f6c1f..269923ba491 100644
--- a/usr.sbin/afs/src/tests/large-dir.c
+++ b/usr.sbin/afs/src/tests/large-dir.c
@@ -93,9 +93,9 @@ creat_files (const char *dirname, int count)
 	if (dp == NULL)
 	    errx (1, "out of entries at %d?", i);
 	if (i == -2)
-	    strcpy (num, ".");
+	    strlcpy (num, ".", sizeof(num));
 	else if (i == -1)
-	    strcpy (num, "..");
+	    strlcpy (num, "..", sizeof(num));
 	else
 	    snprintf (num, sizeof(num), "%d", i);
 	if (strcmp (num, dp->d_name) != 0)
diff --git a/usr.sbin/afs/src/ydr/lex.l b/usr.sbin/afs/src/ydr/lex.l
index 233b2255b65..26bb0d4ce1b 100644
--- a/usr.sbin/afs/src/ydr/lex.l
+++ b/usr.sbin/afs/src/ydr/lex.l
@@ -166,7 +166,7 @@ parse_filename (char *s)
      d2 = strchr (d1, '"');
      *d2 = '\0';
      if (strcmp (d1, "") != 0)
-	 strcpy (filename, d1);
+	 strlcpy (filename, d1, sizeof(filename));
 }
 
 static void
diff --git a/usr.sbin/afs/src/ydr/output.c b/usr.sbin/afs/src/ydr/output.c
index e0e46e0cdd6..f560d2796b8 100644
--- a/usr.sbin/afs/src/ydr/output.c
+++ b/usr.sbin/afs/src/ydr/output.c
@@ -900,7 +900,7 @@ encode_pointer (char *name, Type *type, FILE *f, EncodeType encodetype,
      Type booltype = {TULONG};
      char tmp[256];
 
-     sprintf (tmp, "*(%s)", name);
+     snprintf (tmp, sizeof(tmp), "*(%s)", name);
 
      switch(encodetype) {
      case ENCODE_RX:
@@ -1503,9 +1503,10 @@ gendecodeout (List *list, Listitem *item, void *arg)
 
      if (a->argtype == TOUT || a->argtype == TINOUT) {
 	 if (a->type->type == TPOINTER) {
-	     char *tmp = (char *)emalloc (strlen (a->name) + 4);
+	     size_t len = strlen(a->name) + 4;
+	     char *tmp = (char *)emalloc (len);
 	       
-	     sprintf (tmp, "(*%s)", a->name);
+	     snprintf (tmp, len, "(*%s)", a->name);
 
 	     encode_type (tmp, a->type->subtype, f, DECODE_RX, CLIENT);
 	     free (tmp);
@@ -1527,9 +1528,10 @@ gendecodein (List *list, Listitem *item, void *arg)
      else {
 	  if (a->type->type == TPOINTER) {
 #if 0
-	       char *tmp = (char *)emalloc (strlen (a->name) + 4);
+	       size_t len = strlen(a->name) + 4;
+	       char *tmp = (char *)emalloc (len);
 	       
-	       sprintf (tmp, "(*%s)", a->name);
+	       snprintf (tmp, len, "(*%s)", a->name);
 
 	       encode_type (tmp, a->type->subtype, f, DECODE_RX, SERVER);
 	       free (tmp);