more string cleaning; ok tedu

11 files changed, 40 insertions, 33 deletions

diff --git a/usr.sbin/ppp/ppp/cbcp.c b/usr.sbin/ppp/ppp/cbcp.c
index 5e52ce267ea..e0463189395 100644
--- a/usr.sbin/ppp/ppp/cbcp.c
+++ b/usr.sbin/ppp/ppp/cbcp.c
@@ -23,7 +23,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- *	$OpenBSD: cbcp.c,v 1.16 2002/06/15 08:02:00 brian Exp $
+ *	$OpenBSD: cbcp.c,v 1.17 2003/04/07 23:58:53 deraadt Exp $
  */
 
 #include <sys/param.h>
@@ -430,7 +430,7 @@ cbcp_AdjustResponse(struct cbcp *cbcp, struct cbcp_data *data)
           for (next = strtok(list, ","); next; next = strtok(NULL, ","))
             if (!strcmp(next, addr->addr)) {
               cbcp->fsm.type = CBCP_SERVERNUM;
-              strcpy(cbcp->fsm.phone, next);
+              strlcpy(cbcp->fsm.phone, next, sizeof cbcp->fsm.phone);
               return 1;
             }
         }
@@ -456,7 +456,7 @@ cbcp_AdjustResponse(struct cbcp *cbcp, struct cbcp_data *data)
             for (next = strtok(list, ","); next; next = strtok(NULL, ","))
               if (!strcmp(next, addr->addr)) {
                 cbcp->fsm.type = CBCP_LISTNUM;
-                strcpy(cbcp->fsm.phone, next);
+                strlcpy(cbcp->fsm.phone, next, sizeof cbcp->fsm.phone);
                 return 1;
               }
           } else
@@ -531,7 +531,7 @@ cbcp_CheckResponse(struct cbcp *cbcp, struct cbcp_data *data)
           log_Printf(LogPHASE, "CBCP: Unrecognised address type %d !\n",
                      addr->type);
         else {
-          strcpy(cbcp->fsm.phone, addr->addr);
+          strlcpy(cbcp->fsm.phone, addr->addr, sizeof cbcp->fsm.phone);
           cbcp->fsm.delay = data->delay;
           return CBCP_ACTION_ACK;
         }
@@ -554,7 +554,7 @@ cbcp_CheckResponse(struct cbcp *cbcp, struct cbcp_data *data)
           list[sizeof list - 1] = '\0';
           for (next = strtok(list, ","); next; next = strtok(NULL, ","))
             if (!strcmp(addr->addr, next)) {
-              strcpy(cbcp->fsm.phone, next);
+              strlcpy(cbcp->fsm.phone, next, sizeof cbcp->fsm.phone);
               cbcp->fsm.delay = data->delay;
               return CBCP_ACTION_ACK;
             }
diff --git a/usr.sbin/ppp/ppp/chap.c b/usr.sbin/ppp/ppp/chap.c
index 7d506f3d629..f1d8b3c41cb 100644
--- a/usr.sbin/ppp/ppp/chap.c
+++ b/usr.sbin/ppp/ppp/chap.c
@@ -25,7 +25,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $OpenBSD: chap.c,v 1.37 2003/04/04 20:25:06 deraadt Exp $
+ * $OpenBSD: chap.c,v 1.38 2003/04/07 23:58:53 deraadt Exp $
  */
 
 #include <sys/param.h>
@@ -609,7 +609,7 @@ chap_Failure(struct authinfo *authp)
       ptr += strlen(ptr);
     }
 
-    sprintf(ptr, " V=3 M=Invalid!");
+    snprintf(ptr, buf + sizeof buf - ptr, " V=3 M=Invalid!");
     msg = buf;
   } else
 #endif
diff --git a/usr.sbin/ppp/ppp/datalink.c b/usr.sbin/ppp/ppp/datalink.c
index 83ce82e7fe2..cd7031417a1 100644
--- a/usr.sbin/ppp/ppp/datalink.c
+++ b/usr.sbin/ppp/ppp/datalink.c
@@ -23,7 +23,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- *	$OpenBSD: datalink.c,v 1.42 2002/06/15 08:02:00 brian Exp $
+ *	$OpenBSD: datalink.c,v 1.43 2003/04/07 23:58:53 deraadt Exp $
  */
 
 #include <sys/param.h>
@@ -1427,14 +1427,16 @@ datalink_NextName(struct datalink *dl)
 {
   int f, n;
   char *name, *oname;
+  size_t len;
 
-  n = strlen(dl->name);
-  name = (char *)malloc(n+3);
-  for (f = n - 1; f >= 0; f--)
+  len = strlen(dl->name);
+  name = (char *)malloc(len+3);
+  for (f = len - 1; f >= 0; f--)
     if (!isdigit(dl->name[f]))
       break;
-  n = sprintf(name, "%.*s-", dl->name[f] == '-' ? f : f + 1, dl->name);
-  sprintf(name + n, "%d", atoi(dl->name + f + 1) + 1);
+  snprintf(name, len+3, "%.*s-", dl->name[f] == '-' ? f : f + 1, dl->name);
+  n = strlen(name);
+  snprintf(name + n, len+3 - n, "%d", atoi(dl->name + f + 1) + 1);
   oname = dl->name;
   dl->name = name;
   /* our physical link name isn't updated (it probably isn't created yet) */
diff --git a/usr.sbin/ppp/ppp/deflate.c b/usr.sbin/ppp/ppp/deflate.c
index 62a02a0c4c6..bbd597b1aa0 100644
--- a/usr.sbin/ppp/ppp/deflate.c
+++ b/usr.sbin/ppp/ppp/deflate.c
@@ -23,7 +23,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- *	$OpenBSD: deflate.c,v 1.15 2002/06/15 01:33:23 brian Exp $
+ *	$OpenBSD: deflate.c,v 1.16 2003/04/07 23:58:53 deraadt Exp $
  */
 
 #include <sys/types.h>
@@ -435,7 +435,7 @@ DeflateDispOpts(struct fsm_opt *o)
 {
   static char disp[7];		/* Must be used immediately */
 
-  sprintf(disp, "win %d", (o->data[0]>>4) + 8);
+  snprintf(disp, sizeof disp, "win %d", (o->data[0]>>4) + 8);
   return disp;
 }
 
diff --git a/usr.sbin/ppp/ppp/lcp.c b/usr.sbin/ppp/ppp/lcp.c
index c96d357ba63..cbb45c83a48 100644
--- a/usr.sbin/ppp/ppp/lcp.c
+++ b/usr.sbin/ppp/ppp/lcp.c
@@ -25,7 +25,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $OpenBSD: lcp.c,v 1.37 2002/06/15 08:02:00 brian Exp $
+ * $OpenBSD: lcp.c,v 1.38 2003/04/07 23:58:53 deraadt Exp $
  */
 
 #include <sys/param.h>
@@ -1227,7 +1227,8 @@ LcpDecodeConfig(struct fsm *fp, u_char *cp, u_char *end, int mode_type,
       pos = 0;
       desc[0] = sz ? ' ' : '\0';
       for (pos = 0; sz--; pos++)
-        sprintf(desc+(pos<<1)+1, "%02x", opt->data[pos]);
+        snprintf(desc+(pos<<1)+1, sizeof desc - ((pos<<1)+1),
+	  "%02x", opt->data[pos]);
 
       log_Printf(LogLCP, "%s%s\n", request, desc);
 
diff --git a/usr.sbin/ppp/ppp/log.c b/usr.sbin/ppp/ppp/log.c
index 77fdb76bc72..3bc0a920bad 100644
--- a/usr.sbin/ppp/ppp/log.c
+++ b/usr.sbin/ppp/ppp/log.c
@@ -23,7 +23,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- *	$OpenBSD: log.c,v 1.16 2002/06/15 08:02:00 brian Exp $
+ *	$OpenBSD: log.c,v 1.17 2003/04/07 23:58:53 deraadt Exp $
  */
 
 #include <sys/types.h>
@@ -365,7 +365,7 @@ log_DumpBp(int lev, const char *hdr, const struct mbuf *bp)
       f = bp->m_len;
       ptr = CONST_MBUF_CTOP(bp);
       while (f--) {
-	sprintf(b, " %02x", (int) *ptr);
+	snprintf(b, buf + sizeof buf - b, " %02x", (int) *ptr);
         *c++ = isprint(*ptr) ? *ptr : '.';
         ptr++;
         b += 3;
@@ -400,7 +400,7 @@ log_DumpBuff(int lev, const char *hdr, const u_char *ptr, int n)
       b = buf;
       c = b + 50;
       for (b = buf; b != buf + 48 && n--; b += 3, ptr++) {
-	sprintf(b, " %02x", (int) *ptr);
+	snprintf(b, buf + sizeof buf - b, " %02x", (int) *ptr);
         *c++ = isprint(*ptr) ? *ptr : '.';
       }
       memset(b, ' ', 50 - (b - buf));
diff --git a/usr.sbin/ppp/ppp/mp.c b/usr.sbin/ppp/ppp/mp.c
index df7c0605e6e..deed2b4d766 100644
--- a/usr.sbin/ppp/ppp/mp.c
+++ b/usr.sbin/ppp/ppp/mp.c
@@ -23,7 +23,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- *	$OpenBSD: mp.c,v 1.31 2003/04/04 20:25:06 deraadt Exp $
+ *	$OpenBSD: mp.c,v 1.32 2003/04/07 23:58:53 deraadt Exp $
  */
 
 #include <sys/param.h>
@@ -932,7 +932,8 @@ mp_Enddisc(u_char c, const char *address, int len)
       if (len > sizeof result - header - 1)
         len = sizeof result - header - 1;
       for (f = 0; f < len; f++)
-        sprintf(result + header + 2 * f, "%02x", address[f]);
+        snprintf(result + header + 2 * f, sizeof result - (header + 2 * f),
+	  "%02x", address[f]);
       break;
 
     case ENDDISC_PSN:
@@ -945,7 +946,8 @@ mp_Enddisc(u_char c, const char *address, int len)
       if (len > sizeof result - header - 1)
         len = sizeof result - header - 1;
       for (f = 0; f < len; f++)
-        sprintf(result + header + 2 * f, "%02x", address[f]);
+        snprintf(result + header + 2 * f, sizeof result - (header + 2 * f),
+	  "%02x", address[f]);
       break;
   }
   return result;
@@ -980,7 +982,8 @@ mp_SetEnddisc(struct cmdargs const *arg)
   } else if (arg->argc > arg->argn) {
     if (!strcasecmp(arg->argv[arg->argn], "label")) {
       mp->cfg.enddisc.class = ENDDISC_LOCAL;
-      strcpy(mp->cfg.enddisc.address, arg->bundle->cfg.label);
+      strlcpy(mp->cfg.enddisc.address, arg->bundle->cfg.label,
+	sizeof mp->cfg.enddisc.address);
       mp->cfg.enddisc.len = strlen(mp->cfg.enddisc.address);
     } else if (!strcasecmp(arg->argv[arg->argn], "ip")) {
       if (arg->bundle->ncp.ipcp.my_ip.s_addr == INADDR_ANY)
@@ -1027,7 +1030,8 @@ mp_SetEnddisc(struct cmdargs const *arg)
     } else if (!strcasecmp(arg->argv[arg->argn], "psn")) {
       if (arg->argc > arg->argn+1) {
         mp->cfg.enddisc.class = ENDDISC_PSN;
-        strcpy(mp->cfg.enddisc.address, arg->argv[arg->argn+1]);
+        strlcpy(mp->cfg.enddisc.address, arg->argv[arg->argn+1],
+	  sizeof mp->cfg.enddisc.address);
         mp->cfg.enddisc.len = strlen(mp->cfg.enddisc.address);
       } else {
         log_Printf(LogWARN, "PSN endpoint requires additional data\n");
diff --git a/usr.sbin/ppp/ppp/nat_cmd.c b/usr.sbin/ppp/ppp/nat_cmd.c
index c348b7f809d..d61d9a6441d 100644
--- a/usr.sbin/ppp/ppp/nat_cmd.c
+++ b/usr.sbin/ppp/ppp/nat_cmd.c
@@ -24,7 +24,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- *	$OpenBSD: nat_cmd.c,v 1.22 2002/05/16 01:13:39 brian Exp $
+ *	$OpenBSD: nat_cmd.c,v 1.23 2003/04/07 23:58:53 deraadt Exp $
  */
 
 #include <sys/param.h>
@@ -402,7 +402,7 @@ nat_ProxyRule(struct cmdargs const *arg)
       break;
     if (len)
       cmd[pos++] = ' ';
-    strcpy(cmd + pos, arg->argv[f]);
+    strlcpy(cmd + pos, arg->argv[f], sizeof cmd - pos);
     pos += len;
   }
 
diff --git a/usr.sbin/ppp/ppp/netgraph.c b/usr.sbin/ppp/ppp/netgraph.c
index 8d253560467..aa5337a97a0 100644
--- a/usr.sbin/ppp/ppp/netgraph.c
+++ b/usr.sbin/ppp/ppp/netgraph.c
@@ -145,7 +145,7 @@ ng_MessageOut(struct ngdevice *dev, struct physical *p, const char *data)
       fmt[pos++] = '%';
     fmt[pos++] = data[dpos++];
   }
-  strcpy(fmt + pos, " %s");
+  strlcpy(fmt + pos, " %s", len + 4 - pos);
   data += dpos;
 
   data += strspn(data, " \t");
@@ -519,7 +519,7 @@ ng_Create(struct physical *p)
         }
       } else {
         /* Use lasthook as the hook name */
-        strcpy(hook, lasthook);
+        strlcpy(hook, lasthook, sizeof hook);
         devp++;
       }
 
diff --git a/usr.sbin/ppp/ppp/prompt.c b/usr.sbin/ppp/ppp/prompt.c
index c98514c3a3a..bd353550b2c 100644
--- a/usr.sbin/ppp/ppp/prompt.c
+++ b/usr.sbin/ppp/ppp/prompt.c
@@ -23,7 +23,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- *	$OpenBSD: prompt.c,v 1.14 2003/04/04 20:25:06 deraadt Exp $
+ *	$OpenBSD: prompt.c,v 1.15 2003/04/07 23:58:53 deraadt Exp $
  */
 
 #include <sys/param.h>
@@ -394,7 +394,7 @@ prompt_vPrintf(struct prompt *p, const char *fmt, va_list ap)
       if (len && len < sizeof nfmt - 1 && fmt[len-1] == '\n' &&
           (len == 1 || fmt[len-2] != '\r')) {
         strlcpy(nfmt, fmt, sizeof nfmt);
-        strcpy(nfmt + len - 1, "\r\n");
+        strlcpy(nfmt + len - 1, "\r\n", sizeof nfmt - (len - 1));
         pfmt = nfmt;
       } else
         pfmt = fmt;
diff --git a/usr.sbin/ppp/ppp/route.c b/usr.sbin/ppp/ppp/route.c
index ac20c2027b8..f692f434bad 100644
--- a/usr.sbin/ppp/ppp/route.c
+++ b/usr.sbin/ppp/ppp/route.c
@@ -25,7 +25,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $OpenBSD: route.c,v 1.27 2003/04/04 20:25:06 deraadt Exp $
+ * $OpenBSD: route.c,v 1.28 2003/04/07 23:58:53 deraadt Exp $
  */
 
 #include <sys/param.h>
@@ -125,7 +125,7 @@ p_sockaddr(struct prompt *prompt, struct sockaddr *phost,
 
           MAC = (u_char *)dl->sdl_data + dl->sdl_nlen;
           for (f = 0; f < dl->sdl_alen; f++)
-            sprintf(buf+f*3, "%02x:", MAC[f]);
+            snprintf(buf+f*3, sizeof buf - (f*3), "%02x:", MAC[f]);
           buf[f*3-1] = '\0';
         } else
           strlcpy(buf, "??:??:??:??:??:??", sizeof buf);