>From 7b69d2e6d12a2a7b11f3996d961c5519859fec72 Mon Sep 17 00:00:00 2001
From: Jakub Filak <jfilak@redhat.com>
Date: Mon, 28 May 2012 13:07:09 +0200
Subject: [PATCH 2/5] track#480 : risky sprintf() replaced by secure
 snprintf()

Signed-off-by: Jakub Filak <jfilak@redhat.com>
---
 src/cli/cli-report.c            |    2 +-
 src/gui-wizard-gtk/wizard.c     |    4 ++--
 src/lib/dump_dir.c              |    8 ++++----
 src/lib/get_cmdline.c           |    4 ++--
 src/lib/xfuncs.c                |    2 +-
 src/plugins/reporter-bugzilla.c |    4 ++--
 6 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/src/cli/cli-report.c b/src/cli/cli-report.c
index 33f08d1..5df8c6d 100644
--- a/src/cli/cli-report.c
+++ b/src/cli/cli-report.c
@@ -176,7 +176,7 @@ static int read_crash_report_field(const char *text, problem_data_t *report,
         const char *field)
 {
     char separator[sizeof("\n" FIELD_SEP)-1 + strlen(field) + 2]; // 2 = '\n\0'
-    sprintf(separator, "\n%s%s\n", FIELD_SEP, field);
+    snprintf(separator, sizeof(separator), "\n%s%s\n", FIELD_SEP, field);
     const char *textfield = strstr(text, separator);
     if (!textfield)
         return 0; // exit silently because all fields are optional
diff --git a/src/gui-wizard-gtk/wizard.c b/src/gui-wizard-gtk/wizard.c
index a9f7442..35ff207 100644
--- a/src/gui-wizard-gtk/wizard.c
+++ b/src/gui-wizard-gtk/wizard.c
@@ -412,7 +412,7 @@ static void load_text_to_text_view(GtkTextView *tv, const char *name)
     {
         gtk_text_buffer_insert_at_cursor(tb, str, end - str);
         char buf[8];
-        unsigned len = sprintf(buf, "<%02X>", (unsigned char)*end);
+        unsigned len = snprintf(buf, sizeof(buf), "<%02X>", (unsigned char)*end);
         gtk_text_buffer_insert_at_cursor(tb, buf, len);
         str = end + 1;
     }
@@ -471,7 +471,7 @@ static void append_to_textview(GtkTextView *tv, const char *str)
     {
         gtk_text_buffer_insert_at_cursor(tb, str, end - str);
         char buf[8];
-        unsigned len = sprintf(buf, "<%02X>", (unsigned char)*end);
+        unsigned len = snprintf(buf, sizeof(buf), "<%02X>", (unsigned char)*end);
         gtk_text_buffer_insert_at_cursor(tb, buf, len);
         str = end + 1;
     }
diff --git a/src/lib/dump_dir.c b/src/lib/dump_dir.c
index ef2f411..0a05b71 100644
--- a/src/lib/dump_dir.c
+++ b/src/lib/dump_dir.c
@@ -152,7 +152,7 @@ static int get_and_set_lock(const char* lock_file, const char* pid)
         if (isdigit_str(pid_buf))
         {
             char pid_str[sizeof("/proc/") + sizeof(pid_buf)];
-            sprintf(pid_str, "/proc/%s", pid_buf);
+            snprintf(pid_str, sizeof(pid_str), "/proc/%s", pid_buf);
             if (access(pid_str, F_OK) == 0)
             {
                 log("Lock file '%s' is locked by process %s", lock_file, pid_buf);
@@ -179,7 +179,7 @@ static int dd_lock(struct dump_dir *dd, unsigned sleep_usec, int flags)
         error_msg_and_die("Locking bug on '%s'", dd->dd_dirname);
 
     char pid_buf[sizeof(long)*3 + 2];
-    sprintf(pid_buf, "%lu", (long)getpid());
+    snprintf(pid_buf, sizeof(pid_buf), "%lu", (long)getpid());
 
     unsigned dirname_len = strlen(dd->dd_dirname);
     char lock_buf[dirname_len + sizeof("/.lock")];
@@ -464,13 +464,13 @@ void dd_create_basic_files(struct dump_dir *dd, uid_t uid)
     char long_str[sizeof(long) * 3 + 2];
 
     time_t t = time(NULL);
-    sprintf(long_str, "%lu", (long)t);
+    snprintf(long_str, sizeof(long_str), "%lu", (long)t);
     dd_save_text(dd, FILENAME_TIME, long_str);
 
     /* it doesn't make sense to create the uid file if uid == -1 */
     if (uid != (uid_t)-1L)
     {
-        sprintf(long_str, "%li", (long)uid);
+        snprintf(long_str, sizeof(long_str), "%li", (long)uid);
         dd_save_text(dd, FILENAME_UID, long_str);
     }
 
diff --git a/src/lib/get_cmdline.c b/src/lib/get_cmdline.c
index 4f86fa2..55c49ea 100644
--- a/src/lib/get_cmdline.c
+++ b/src/lib/get_cmdline.c
@@ -138,13 +138,13 @@ static char* get_escaped(const char *path, char separator)
 char* get_cmdline(pid_t pid)
 {
     char path[sizeof("/proc/%lu/cmdline") + sizeof(long)*3];
-    sprintf(path, "/proc/%lu/cmdline", (long)pid);
+    snprintf(path, sizeof(path), "/proc/%lu/cmdline", (long)pid);
     return get_escaped(path, ' ');
 }
 
 char* get_environ(pid_t pid)
 {
     char path[sizeof("/proc/%lu/environ") + sizeof(long)*3];
-    sprintf(path, "/proc/%lu/environ", (long)pid);
+    snprintf(path, sizeof(path), "/proc/%lu/environ", (long)pid);
     return get_escaped(path, '\n');
 }
diff --git a/src/lib/xfuncs.c b/src/lib/xfuncs.c
index 88ae0bc..99cbd42 100644
--- a/src/lib/xfuncs.c
+++ b/src/lib/xfuncs.c
@@ -193,7 +193,7 @@ char* xvasprintf(const char *format, va_list p)
 }
 
 // Die with an error message if we can't malloc() enough space and do an
-// sprintf() into that space.
+// sprintf() into that space., sizeof() into that space.)
 char* xasprintf(const char *format, ...)
 {
     va_list p;
diff --git a/src/plugins/reporter-bugzilla.c b/src/plugins/reporter-bugzilla.c
index 9746301..b96549d 100644
--- a/src/plugins/reporter-bugzilla.c
+++ b/src/plugins/reporter-bugzilla.c
@@ -344,7 +344,7 @@ int main(int argc, char **argv)
 
             log(_("Adding attachments to bug %i"), bug_id);
             char bug_id_str[sizeof(int)*3 + 2];
-            sprintf(bug_id_str, "%i", bug_id);
+            snprintf(bug_id_str, sizeof(bug_id_str), "%i", bug_id);
 
             int flags = RHBZ_NOMAIL_NOTIFY;
             if (opts & OPT_b)
@@ -445,7 +445,7 @@ int main(int argc, char **argv)
             if (!dup_comment && (rating > bz->bi_best_bt_rating))
             {
                 char bug_id_str[sizeof(int)*3 + 2];
-                sprintf(bug_id_str, "%i", bz->bi_id);
+                snprintf(bug_id_str, sizeof(bug_id_str), "%i", bz->bi_id);
 
                 const char *bt =  get_problem_item_content_or_NULL(problem_data,
                                                                    FILENAME_BACKTRACE);
-- 
1.7.7.6

