Commit feb2dd28 authored by Daniel Stenberg's avatar Daniel Stenberg
Browse files

Replaced all uses of sprintf() with the safer snprintf(). It is just a 

precaution to prevent mistakes to lead to buffer overflows.
parent 5e34f3dc

lib/base64.c

+12 −12
Original line number Diff line number Diff line
@@ -160,18 +160,18 @@ size_t Curl_base64_encode(const char *inp, size_t insize, char **outptr) 


    switch(inputparts) {

    case 1: /* only one byte read */

      sprintf(output, "%c%c==",

      snprintf(output, 5, "%c%c==",

               table64[obuf[0]],

               table64[obuf[1]]);

      break;

    case 2: /* two bytes read */

      sprintf(output, "%c%c%c=",

      snprintf(output, 5, "%c%c%c=",

               table64[obuf[0]],

               table64[obuf[1]],

               table64[obuf[2]]);

      break;

    default:

      sprintf(output, "%c%c%c%c",

      snprintf(output, 5, "%c%c%c%c",

               table64[obuf[0]],

               table64[obuf[1]],

               table64[obuf[2]],

lib/escape.c

+1 −1
Original line number Diff line number Diff line
@@ -68,7 +68,7 @@ char *curl_escape(const char *string, int length) 
          ns = testing_ptr;

        }

      }

      sprintf(&ns[strindex], "%%%02X", in);

      snprintf(&ns[strindex], 4, "%%%02X", in);



      strindex+=3;

    }

lib/file.c

+4 −3
Original line number Diff line number Diff line
@@ -300,13 +300,14 @@ CURLcode Curl_file(struct connectdata *conn) 
     date. */

  if(conn->bits.no_body && data->set.include_header && fstated) {

    CURLcode result;

    sprintf(buf, "Content-Length: %" FORMAT_OFF_T "\r\n", expected_size);

    snprintf(buf, sizeof(data->state.buffer),

             "Content-Length: %" FORMAT_OFF_T "\r\n", expected_size);

    result = Curl_client_write(data, CLIENTWRITE_BOTH, buf, 0);

    if(result)

      return result;



    sprintf(buf, "Accept-ranges: bytes\r\n");

    result = Curl_client_write(data, CLIENTWRITE_BOTH, buf, 0);

    result = Curl_client_write(data, CLIENTWRITE_BOTH,

                               "Accept-ranges: bytes\r\n", 0);

    if(result)

      return result;

lib/formdata.c

+1 −1
Original line number Diff line number Diff line
@@ -846,7 +846,7 @@ static CURLcode AddFormDataf(struct FormData **formp, 
  char s[4096];

  va_list ap;

  va_start(ap, fmt);

  vsprintf(s, fmt, ap);

  vsnprintf(s, sizeof(s), fmt, ap);

  va_end(ap);



  return AddFormData(formp, FORM_DATA, s, 0, size);

lib/ftp.c

+7 −4
Original line number Diff line number Diff line
@@ -932,7 +932,8 @@ CURLcode ftp_getfiletime(struct connectdata *conn, char *file) 
                     &year, &month, &day, &hour, &minute, &second)) {

        /* we have a time, reformat it */

        time_t secs=time(NULL);

        sprintf(buf, "%04d%02d%02d %02d:%02d:%02d GMT",

        snprintf(buf, sizeof(conn->data->state.buffer),

                 "%04d%02d%02d %02d:%02d:%02d GMT",

                 year, month, day, hour, minute, second);

        /* now, convert this into a time() value: */

        conn->data->info.filetime = curl_getdate(buf, &secs);
@@ -1506,7 +1507,8 @@ CURLcode ftp_use_pasv(struct connectdata *conn, 
      return CURLE_FTP_WEIRD_227_FORMAT;

    }



    sprintf(newhost, "%d.%d.%d.%d", ip[0], ip[1], ip[2], ip[3]);

    snprintf(newhost, sizeof(newhost),

             "%d.%d.%d.%d", ip[0], ip[1], ip[2], ip[3]);

    newhostp = newhost;

    newport = (port[0]<<8) + port[1];

  }
@@ -2161,7 +2163,8 @@ CURLcode ftp_perform(struct connectdata *conn, 
    result = ftp_getsize(conn, ftp->file, &filesize);



    if(CURLE_OK == result) {

      sprintf(buf, "Content-Length: %" FORMAT_OFF_T "\r\n", filesize);

      snprintf(buf, sizeof(data->state.buffer),

               "Content-Length: %" FORMAT_OFF_T "\r\n", filesize);

      result = Curl_client_write(data, CLIENTWRITE_BOTH, buf, 0);

      if(result)

        return result;