Examine all occurrences of sprintf(), strcat(), and str[n]cpy()

for possible buffer overflow problems. Replaced most sprintf()'s
with snprintf(); for others cases, added terminating NUL bytes where
appropriate, replaced constants like "16" with sizeof(), etc.

These changes include several bug fixes, but most changes are for
maintainability's sake. Any instance where it wasn't "immediately
obvious" that a buffer overflow could not occur was made safer.

Reviewed by:	Bruce Evans <bde@zeta.org.au>
Reviewed by:	Matthew Dillon <dillon@apollo.backplane.com>
Reviewed by:	Mike Spengler <mks@networkcs.com>

9 files changed, 24 insertions, 16 deletions

diff --git a/sys/i386/isa/sound/ad1848.c b/sys/i386/isa/sound/ad1848.c
index fbd5051..08b0a1e 100644
--- a/sys/i386/isa/sound/ad1848.c
+++ b/sys/i386/isa/sound/ad1848.c
@@ -1440,11 +1440,13 @@ ad1848_init(char *name, int io_base, int irq,
     outb(io_Status(devc), 0);	/* Clear pending interrupts */
 
     if (name != NULL && name[0] != 0)
-	sprintf(ad1848_pcm_operations[nr_ad1848_devs].name,
-	    "%s (%s)", name, devc->chip_name);
+	snprintf(ad1848_pcm_operations[nr_ad1848_devs].name,
+	    sizeof(ad1848_pcm_operations[nr_ad1848_devs].name),
+		"%s (%s)", name, devc->chip_name);
     else
-	sprintf(ad1848_pcm_operations[nr_ad1848_devs].name,
-	    "Generic audio codec (%s)", devc->chip_name);
+	snprintf(ad1848_pcm_operations[nr_ad1848_devs].name,
+	    sizeof(ad1848_pcm_operations[nr_ad1848_devs].name),
+		"Generic audio codec (%s)", devc->chip_name);
 
     conf_printf2(ad1848_pcm_operations[nr_ad1848_devs].name,
 	     devc->base, devc->irq, dma_playback, dma_capture);
diff --git a/sys/i386/isa/sound/gus_wave.c b/sys/i386/isa/sound/gus_wave.c
index 9b3ab0b..54d36cb 100644
--- a/sys/i386/isa/sound/gus_wave.c
+++ b/sys/i386/isa/sound/gus_wave.c
@@ -4517,9 +4517,11 @@ gus_wave_init(struct address_info * hw_config)
     }
 
     if (gus_pnp_seen) {
-	sprintf(gus_info.name, "Gravis %s (%dk)", model_num, (int) gus_mem_size / 1024);
+	snprintf(gus_info.name, sizeof(gus_info.name),
+	    "Gravis %s (%dk)", model_num, (int) gus_mem_size / 1024);
     } else {
-	sprintf(gus_info.name, "Gravis UltraSound %s (%dk)", model_num, (int) gus_mem_size / 1024);
+	snprintf(gus_info.name, sizeof(gus_info.name),
+	    "Gravis UltraSound %s (%dk)", model_num, (int) gus_mem_size / 1024);
     }
     conf_printf(gus_info.name, hw_config);
 
diff --git a/sys/i386/isa/sound/mpu401.c b/sys/i386/isa/sound/mpu401.c
index fdfb94d..0bd1412 100644
--- a/sys/i386/isa/sound/mpu401.c
+++ b/sys/i386/isa/sound/mpu401.c
@@ -1002,7 +1002,8 @@ attach_mpu401(struct address_info * hw_config)
 			MPU_CAP_CLS | MPU_CAP_2PORT;
 
 	revision_char = (devc->revision == 0x7f) ? 'M' : ' ';
-	sprintf(mpu_synth_info[num_midis].name,
+	snprintf(mpu_synth_info[num_midis].name,
+	    sizeof(mpu_synth_info[num_midis].name),
 		"MQX-%d%c MIDI Interface #%d",
 		ports,
 		revision_char,
@@ -1015,7 +1016,8 @@ attach_mpu401(struct address_info * hw_config)
 
 	devc->capabilities |= MPU_CAP_SYNC | MPU_CAP_FSK;
 
-	sprintf(mpu_synth_info[num_midis].name,
+	snprintf(mpu_synth_info[num_midis].name,
+	    sizeof(mpu_synth_info[num_midis].name),
 	    "MPU-401 %d.%d%c Midi interface #%d",
 	    (int) (devc->version & 0xf0) >> 4,
 	    devc->version & 0x0f,
diff --git a/sys/i386/isa/sound/pas2_card.c b/sys/i386/isa/sound/pas2_card.c
index 06ab9f2..dc78afa 100644
--- a/sys/i386/isa/sound/pas2_card.c
+++ b/sys/i386/isa/sound/pas2_card.c
@@ -325,7 +325,7 @@ attach_pas_card(struct address_info * hw_config)
 		if ((pas_model = pas_read(CHIP_REV))) {
 			char            temp[100];
 
-			sprintf(temp,
+			snprintf(temp, sizeof(temp),
 			      "%s rev %d", pas_model_names[(int) pas_model],
 				pas_read(BOARD_REV_ID));
 			conf_printf(temp, hw_config);
diff --git a/sys/i386/isa/sound/pcm86.c b/sys/i386/isa/sound/pcm86.c
index 0df86b1..4efec0d 100644
--- a/sys/i386/isa/sound/pcm86.c
+++ b/sys/i386/isa/sound/pcm86.c
@@ -25,7 +25,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $Id: pcm86.c,v 1.3 1997/02/22 09:38:14 peter Exp $
+ * $Id: pcm86.c,v 1.4 1997/06/03 10:25:41 kato Exp $
  */
 
 /*
@@ -1890,7 +1890,8 @@ pcm86_detect(struct address_info *hw_config)
     outb(opna_iobase + 2, 0x30);
 
     /* Ok.  Detection finished. */
-    sprintf(pcm86_operations.name, board_name[pcm_s.board_type]);
+    snprintf(pcm86_operations.name, sizeof(pcm86_operations.name),
+	"%s", board_name[pcm_s.board_type]);
     pcm_initialized = NO;
     pcm_s.irq = irq;
 
diff --git a/sys/i386/isa/sound/pss.c b/sys/i386/isa/sound/pss.c
index 17acfb2..a6a5b65 100644
--- a/sys/i386/isa/sound/pss.c
+++ b/sys/i386/isa/sound/pss.c
@@ -348,7 +348,7 @@ attach_pss(struct address_info * hw_config)
 #endif
 
 	pss_initialized = 1;
-	sprintf(tmp, "ECHO-PSS  Rev. %d", id);
+	snprintf(tmp, sizeof(tmp), "ECHO-PSS  Rev. %d", id);
 	conf_printf(tmp, hw_config);
 
 	return;
diff --git a/sys/i386/isa/sound/sb16_dsp.c b/sys/i386/isa/sound/sb16_dsp.c
index ad9be54..f94675b 100644
--- a/sys/i386/isa/sound/sb16_dsp.c
+++ b/sys/i386/isa/sound/sb16_dsp.c
@@ -450,8 +450,8 @@ sb16_dsp_init(struct address_info * hw_config)
     if (sbc_major < 4)
 	return;		/* Not a SB16 */
 
-    sprintf(sb16_dsp_operations.name, "SoundBlaster 16 %d.%d",
-		sbc_major, sbc_minor);
+    snprintf(sb16_dsp_operations.name, sizeof(sb16_dsp_operations.name),
+	"SoundBlaster 16 %d.%d", sbc_major, sbc_minor);
 
     conf_printf(sb16_dsp_operations.name, hw_config);
 
diff --git a/sys/i386/isa/sound/sb_dsp.c b/sys/i386/isa/sound/sb_dsp.c
index 1cf52c5..7d48ec8 100644
--- a/sys/i386/isa/sound/sb_dsp.c
+++ b/sys/i386/isa/sound/sb_dsp.c
@@ -1081,7 +1081,8 @@ sb_dsp_init(struct address_info * hw_config)
 	fmt = "SoundBlaster %d.%d" ;
     }
 
-    sprintf(sb_dsp_operations.name, fmt, sbc_major, sbc_minor);
+    snprintf(sb_dsp_operations.name, sizeof(sb_dsp_operations.name),
+	fmt, sbc_major, sbc_minor);
     conf_printf(sb_dsp_operations.name, hw_config);
 
 #if defined(CONFIG_SB16) && defined(CONFIG_SBPRO)
diff --git a/sys/i386/isa/sound/sound_timer.c b/sys/i386/isa/sound/sound_timer.c
index 8450b2d..cef7596 100644
--- a/sys/i386/isa/sound/sound_timer.c
+++ b/sys/i386/isa/sound/sound_timer.c
@@ -335,7 +335,7 @@ sound_timer_init(struct sound_lowlev_timer * t, char *name)
     else
 	n = num_sound_timers++;
 
-    strcpy(sound_timer.info.name, name);
+    snprintf(sound_timer.info.name, sizeof(sound_timer.info.name), "%s", name);
 
     sound_timer_devs[n] = &sound_timer;
 }