diff options
author | robert <robert@FreeBSD.org> | 2002-08-15 21:19:31 +0000 |
---|---|---|
committer | robert <robert@FreeBSD.org> | 2002-08-15 21:19:31 +0000 |
commit | fe770f50bf1675781f47c1d056f4aa8468011596 (patch) | |
tree | cd1c9e51eb23323a92ebc36ddc0e35200c7afcfb /lib/libc/net | |
parent | 40c52b591349f2d4fd430ad583b5b179f45a2512 (diff) | |
download | FreeBSD-src-fe770f50bf1675781f47c1d056f4aa8468011596.zip FreeBSD-src-fe770f50bf1675781f47c1d056f4aa8468011596.tar.gz |
- Fix a bug that wrote one char behind the end of the
supplied buffer in case the size of it was equal to
the number of characters the converted address consumed.
The bug occurred when converting an AF_INET address.
- Remove the SPRINTF macro and use sprintf instead.
- Do not do string formatting using sprintf(3) and a
temporary buffer which is copied when the supplied
buffer provides enough space. Instead, use snprintf(3)
and the real destination buffer, thus avoid the copy.
Reported by: Stefan Farfeleder <e0026813@stud3.tuwien.ac.at> (1)
PR: misc/41289
Diffstat (limited to 'lib/libc/net')
-rw-r--r-- | lib/libc/net/inet_ntop.c | 9 |
1 files changed, 3 insertions, 6 deletions
diff --git a/lib/libc/net/inet_ntop.c b/lib/libc/net/inet_ntop.c index 534c968..93e175c 100644 --- a/lib/libc/net/inet_ntop.c +++ b/lib/libc/net/inet_ntop.c @@ -30,8 +30,6 @@ __FBSDID("$FreeBSD$"); #include <stdio.h> #include <string.h> -#define SPRINTF(x) ((socklen_t)sprintf x) - /* * WARNING: Don't even consider trying to compile this on a system where * sizeof(int) < 4. sizeof(int) > 4 is fine; all the world's not a VAX. @@ -79,13 +77,12 @@ static const char * inet_ntop4(const u_char *src, char *dst, socklen_t size) { static const char fmt[] = "%u.%u.%u.%u"; - char tmp[sizeof "255.255.255.255"]; - if (SPRINTF((tmp, fmt, src[0], src[1], src[2], src[3])) > size) { + if ((socklen_t)snprintf(dst, size, fmt, src[0], src[1], src[2], src[3]) + >= size) { errno = ENOSPC; return (NULL); } - strcpy(dst, tmp); return (dst); } @@ -164,7 +161,7 @@ inet_ntop6(const u_char *src, char *dst, socklen_t size) tp += strlen(tp); break; } - tp += SPRINTF((tp, "%x", words[i])); + tp += sprintf(tp, "%x", words[i]); } /* Was it a trailing run of 0x00's? */ if (best.base != -1 && (best.base + best.len) == |