diff options
Diffstat (limited to 'usr.sbin/lpr/lpd/printjob.c')
| -rw-r--r-- | usr.sbin/lpr/lpd/printjob.c | 36 |
1 files changed, 25 insertions, 11 deletions
diff --git a/usr.sbin/lpr/lpd/printjob.c b/usr.sbin/lpr/lpd/printjob.c index dff077b5dc6..21370f43bd9 100644 --- a/usr.sbin/lpr/lpd/printjob.c +++ b/usr.sbin/lpr/lpd/printjob.c @@ -1,4 +1,4 @@ -/* $OpenBSD: printjob.c,v 1.8 1996/09/30 21:24:34 deraadt Exp $ */ +/* $OpenBSD: printjob.c,v 1.9 1996/10/25 19:38:23 deraadt Exp $ */ /* $NetBSD: printjob.c,v 1.9.4.3 1996/07/12 22:31:39 jtc Exp $ */ /* @@ -219,7 +219,7 @@ again: errcnt = 0; restart: (void) lseek(lfd, pidoff, 0); - (void) sprintf(line, "%s\n", q->q_name); + (void) snprintf(line, sizeof line, "%s\n", q->q_name); i = strlen(line); if (write(lfd, line, i) != i) syslog(LOG_ERR, "%s: %s: %m", printer, LO); @@ -377,13 +377,17 @@ printit(file) while (getline(cfp)) switch (line[0]) { case 'H': - strcpy(fromhost, line+1); - if (class[0] == '\0') + strncpy(fromhost, line+1, sizeof(fromhost)-1); + fromhost[sizeof(fromhost)-1] = '\0'; + if (class[0] == '\0') { strncpy(class, line+1, sizeof(class)-1); + class[sizeof(class)-1] = '\0'; + } continue; case 'P': strncpy(logname, line+1, sizeof(logname)-1); + logname[sizeof(logname)-1] = '\0'; if (RS) { /* restricted */ if (getpwnam(logname) == NULL) { bombed = NOACCT; @@ -407,9 +411,10 @@ printit(file) continue; case 'J': - if (line[1] != '\0') + if (line[1] != '\0') { strncpy(jobname, line+1, sizeof(jobname)-1); - else + jobname[sizeof(jobname)-1] = '\0'; + } else strcpy(jobname, " "); continue; @@ -418,10 +423,12 @@ printit(file) strncpy(class, line+1, sizeof(class)-1); else if (class[0] == '\0') gethostname(class, sizeof(class)); + class[sizeof(class)-1] = '\0'; continue; case 'T': /* header title for pr */ strncpy(title, line+1, sizeof(title)-1); + title[sizeof(title)-1] = '\0'; continue; case 'L': /* identification line */ @@ -433,16 +440,21 @@ printit(file) case '2': case '3': case '4': - if (line[1] != '\0') - strcpy(fonts[line[0]-'1'], line+1); + if (line[1] != '\0') { + strncpy(fonts[line[0]-'1'], line+1, + 50-1); + fonts[line[0]-'1'][50-1] = '\0'; + } continue; case 'W': /* page width */ strncpy(width+2, line+1, sizeof(width)-3); + width[2+sizeof(width)-3] = '\0'; continue; case 'I': /* indent amount */ strncpy(indent+2, line+1, sizeof(indent)-3); + indent[2+sizeof(indent)-3] = '\0'; continue; default: /* some file to print */ @@ -844,7 +856,9 @@ sendfile(type, file) if ((stb.st_mode & S_IFMT) == S_IFLNK && fstat(f, &stb) == 0 && (stb.st_dev != fdev || stb.st_ino != fino)) return(ACCESS); - (void) sprintf(buf, "%c%qd %s\n", type, stb.st_size, file); + if (snprintf(buf, sizeof buf, "%c%qd %s\n", type, + stb.st_size, file) > sizeof buf-1) + return (ACCESS); /* XXX hack */ amt = strlen(buf); for (i = 0; ; i++) { if (write(pfd, buf, amt) != amt || @@ -1049,7 +1063,7 @@ sendmail(user, bombed) cp++; else cp = _PATH_SENDMAIL; - sprintf(buf, "%s@%s", user, fromhost); + snprintf(buf, sizeof buf, "%s@%s", user, fromhost); execl(_PATH_SENDMAIL, cp, buf, 0); exit(0); } else if (s > 0) { /* parent */ @@ -1382,7 +1396,7 @@ openrem() resp = -1; pfd = getport(RM, 0); if (pfd >= 0) { - (void) sprintf(line, "\2%s\n", RP); + (void) snprintf(line, sizeof line, "\2%s\n", RP); n = strlen(line); if (write(pfd, line, n) == n && (resp = response()) == '\0') |