Be more careful with snprintf return value handling. Some of these are

from Han Boetes (thanks), some with modifications by me.  OK from and
corrections from niallo@

6 files changed, 28 insertions, 18 deletions

diff --git a/usr.sbin/bind/bin/named/server.c b/usr.sbin/bind/bin/named/server.c
index 11bd82ec730..0d2ae6f5d70 100644
--- a/usr.sbin/bind/bin/named/server.c
+++ b/usr.sbin/bind/bin/named/server.c
@@ -4003,7 +4003,7 @@ ns_server_flushname(ns_server_t *server, char *args) {
 isc_result_t
 ns_server_status(ns_server_t *server, isc_buffer_t *text) {
 	int zonecount, xferrunning, xferdeferred, soaqueries;
-	unsigned int n;
+	int n;
 
 	zonecount = dns_zonemgr_getcount(server->zonemgr, DNS_ZONESTATE_ANY);
 	xferrunning = dns_zonemgr_getcount(server->zonemgr,
@@ -4027,9 +4027,12 @@ ns_server_status(ns_server_t *server, isc_buffer_t *text) {
 		     soaqueries, server->log_queries ? "ON" : "OFF",
 		     server->recursionquota.used, server->recursionquota.max,
 		     server->tcpquota.used, server->tcpquota.max);
-	if (n >= isc_buffer_availablelength(text))
+	if (n == -1)
+		return (ISC_R_FAILURE);
+	else if ((unsigned int)n >= isc_buffer_availablelength(text))
 		return (ISC_R_NOSPACE);
-	isc_buffer_add(text, n);
+
+	isc_buffer_add(text, (unsigned int)n);
 	return (ISC_R_SUCCESS);
 }
 
diff --git a/usr.sbin/bind/bin/named/unix/os.c b/usr.sbin/bind/bin/named/unix/os.c
index 7bbf88ac79d..45a141e02ca 100644
--- a/usr.sbin/bind/bin/named/unix/os.c
+++ b/usr.sbin/bind/bin/named/unix/os.c
@@ -661,7 +661,7 @@ next_token(char **stringp, const char *delim) {
 void
 ns_os_shutdownmsg(char *command, isc_buffer_t *text) {
 	char *input, *ptr;
-	unsigned int n;
+	int n;
 	pid_t pid;
 
 	input = command;
@@ -688,8 +688,8 @@ ns_os_shutdownmsg(char *command, isc_buffer_t *text) {
 		     isc_buffer_availablelength(text),
 		     "pid: %ld", (long)pid);
 	/* Only send a message if it is complete. */
-	if (n < isc_buffer_availablelength(text))
-		isc_buffer_add(text, n);
+	if (n != -1 && n < isc_buffer_availablelength(text))
+		isc_buffer_add(text, (unsigned int)n);
 }
 
 void
diff --git a/usr.sbin/bind/lib/dns/dst_api.c b/usr.sbin/bind/lib/dns/dst_api.c
index d4192aa386d..43615971626 100644
--- a/usr.sbin/bind/lib/dns/dst_api.c
+++ b/usr.sbin/bind/lib/dns/dst_api.c
@@ -1173,8 +1173,11 @@ addsuffix(char *filename, unsigned int len, const char *ofilename,
 		olen -= 4;
 
 	n = snprintf(filename, len, "%.*s%s", olen, ofilename, suffix);
-	if (n < 0)
+	if (n == -1)
+		return (ISC_R_FAILURE);
+	if ((unsigned int)n >= len)
 		return (ISC_R_NOSPACE);
+
 	return (ISC_R_SUCCESS);
 }
 
diff --git a/usr.sbin/bind/lib/dns/master.c b/usr.sbin/bind/lib/dns/master.c
index c09214b2f3e..c7dd7fc0d37 100644
--- a/usr.sbin/bind/lib/dns/master.c
+++ b/usr.sbin/bind/lib/dns/master.c
@@ -564,7 +564,7 @@ genname(char *name, int it, char *buffer, size_t length) {
 	char mode[2];
 	int delta = 0;
 	isc_textregion_t r;
-	unsigned int n;
+	int n;
 	unsigned int width;
 
 	r.base = buffer;
@@ -599,14 +599,18 @@ genname(char *name, int it, char *buffer, size_t length) {
 				default:
 					return (DNS_R_SYNTAX);
 				}
-				if (n >= sizeof(fmt))
+				if (n == -1)
+					return (ISC_R_FAILURE);
+				else if ((size_t)n >= sizeof(fmt))
 					return (ISC_R_NOSPACE);
 				/* Skip past closing brace. */
 				while (*name != '\0' && *name++ != '}')
 					continue;
 			}
 			n = snprintf(numbuf, sizeof(numbuf), fmt, it + delta);
-			if (n >= sizeof(numbuf))
+			if (n == -1)
+				return (ISC_R_FAILURE);
+			else if ((size_t)n >= sizeof(numbuf))
 				return (ISC_R_NOSPACE);
 			cp = numbuf;
 			while (*cp != '\0') {
diff --git a/usr.sbin/bind/lib/dns/masterdump.c b/usr.sbin/bind/lib/dns/masterdump.c
index c51825890fc..0ff669d4da6 100644
--- a/usr.sbin/bind/lib/dns/masterdump.c
+++ b/usr.sbin/bind/lib/dns/masterdump.c
@@ -381,18 +381,18 @@ rdataset_totext(dns_rdataset_t *rdataset,
 		{
 			char ttlbuf[64];
 			isc_region_t r;
-			unsigned int length;
+			int length;
 
 			INDENT_TO(ttl_column);
 			length = snprintf(ttlbuf, sizeof(ttlbuf), "%u",
 					  rdataset->ttl);
-			INSIST(length <= sizeof(ttlbuf));
+			INSIST(length != -1 && (size_t)length < sizeof(ttlbuf));
 			isc_buffer_availableregion(target, &r);
-			if (r.length < length)
+			if (r.length < (unsigned int)length)
 				return (ISC_R_NOSPACE);
-			memcpy(r.base, ttlbuf, length);
-			isc_buffer_add(target, length);
-			column += length;
+			memcpy(r.base, ttlbuf, (size_t)length);
+			isc_buffer_add(target, (unsigned int)length);
+			column += (unsigned int)length;
 
 			/*
 			 * If the $TTL directive is not in use, the TTL we
diff --git a/usr.sbin/bind/lib/dns/rdata/in_1/apl_42.c b/usr.sbin/bind/lib/dns/rdata/in_1/apl_42.c
index 03fbce75cd6..456b948a9ae 100644
--- a/usr.sbin/bind/lib/dns/rdata/in_1/apl_42.c
+++ b/usr.sbin/bind/lib/dns/rdata/in_1/apl_42.c
@@ -141,7 +141,7 @@ totext_in_apl(ARGS_TOTEXT) {
 		INSIST(len <= sr.length);
 		n = snprintf(txt, sizeof(txt), "%s%s%u:", sep,
 			     neg ? "!": "", afi);
-		INSIST(n < (int)sizeof(txt));
+		INSIST(n != -1 && (size_t)n < sizeof(txt));
 		RETERR(str_totext(txt, target));
 		switch (afi) {
 		case 1:
@@ -164,7 +164,7 @@ totext_in_apl(ARGS_TOTEXT) {
 			return (ISC_R_NOTIMPLEMENTED);
 		}
 		n = snprintf(txt, sizeof(txt), "/%u", prefix);
-		INSIST(n < (int)sizeof(txt));
+		INSIST(n != -1 && (size_t)n < sizeof(txt));
 		RETERR(str_totext(txt, target));
 		isc_region_consume(&sr, len);
 		sep = " ";