db/btree/bt_open.c: check return value of snprintf() and return value

if the result is truncated.

db/hash/hash_page.c: use the same way to create temporary file as
bt_open.c; check snprintf() return value.

Obtained from:	OpenBSD

1 files changed, 6 insertions, 2 deletions

diff --git a/lib/libc/db/btree/bt_open.c b/lib/libc/db/btree/bt_open.c
index ec6239f..7422ca4 100644
--- a/lib/libc/db/btree/bt_open.c
+++ b/lib/libc/db/btree/bt_open.c
@@ -383,14 +383,18 @@ static int
 tmp(void)
 {
 	sigset_t set, oset;
-	int fd;
+	int fd, len;
 	char *envtmp = NULL;
 	char path[MAXPATHLEN];
 
 	if (issetugid() == 0)
 		envtmp = getenv("TMPDIR");
-	(void)snprintf(path,
+	len = snprintf(path,
 	    sizeof(path), "%s/bt.XXXXXXXXXX", envtmp ? envtmp : "/tmp");
+	if (len < 0 || len >= (int)sizeof(path)) {
+		errno = ENAMETOOLONG;
+		return(-1);
+	}
 
 	(void)sigfillset(&set);
 	(void)_sigprocmask(SIG_BLOCK, &set, &oset);