Examine all occurrences of sprintf(), strcat(), and str[n]cpy()

for possible buffer overflow problems. Replaced most sprintf()'s
with snprintf(); for others cases, added terminating NUL bytes where
appropriate, replaced constants like "16" with sizeof(), etc.

These changes include several bug fixes, but most changes are for
maintainability's sake. Any instance where it wasn't "immediately
obvious" that a buffer overflow could not occur was made safer.

Reviewed by:	Bruce Evans <bde@zeta.org.au>
Reviewed by:	Matthew Dillon <dillon@apollo.backplane.com>
Reviewed by:	Mike Spengler <mks@networkcs.com>

4 files changed, 61 insertions, 45 deletions

diff --git a/sys/netatm/spans/spans_arp.c b/sys/netatm/spans/spans_arp.c
index bdcacc6..a324fc4 100644
--- a/sys/netatm/spans/spans_arp.c
+++ b/sys/netatm/spans/spans_arp.c
@@ -23,7 +23,7 @@
  * Copies of this Software may be made, however, the above copyright
  * notice must be reproduced on all copies.
  *
- *	@(#) $Id: spans_arp.c,v 1.1 1998/09/15 08:23:02 phk Exp $
+ *	@(#) $Id: spans_arp.c,v 1.2 1998/10/31 20:06:56 phk Exp $
  *
  */
 
@@ -44,7 +44,7 @@
 #include <netatm/spans/spans_cls.h>
 
 #ifndef lint
-__RCSID("@(#) $Id: spans_arp.c,v 1.1 1998/09/15 08:23:02 phk Exp $");
+__RCSID("@(#) $Id: spans_arp.c,v 1.2 1998/10/31 20:06:56 phk Exp $");
 #endif
 
 
@@ -1089,7 +1089,8 @@ spansarp_ioctl(code, data, arg1)
 					AF_INET;
 				SATOSIN(&aar.aap_arp_addr)->sin_addr.s_addr =
 					sap->sa_dstip.s_addr;
-				(void) sprintf(aar.aap_intf, "%s%d",
+				(void) snprintf(aar.aap_intf,
+				    sizeof(aar.aap_intf), "%s%d",
 					clp->cls_ipnif->inf_nif->nif_if.if_name,
 					clp->cls_ipnif->inf_nif->nif_if.if_unit
 					);
diff --git a/sys/netatm/spans/spans_cls.c b/sys/netatm/spans/spans_cls.c
index f4a6ba8..17dc135 100644
--- a/sys/netatm/spans/spans_cls.c
+++ b/sys/netatm/spans/spans_cls.c
@@ -23,7 +23,7 @@
  * Copies of this Software may be made, however, the above copyright
  * notice must be reproduced on all copies.
  *
- *	@(#) $Id: spans_cls.c,v 1.1 1998/09/15 08:23:03 phk Exp $
+ *	@(#) $Id: spans_cls.c,v 1.2 1998/10/31 20:06:56 phk Exp $
  *
  */
 
@@ -44,7 +44,7 @@
 #include <netatm/spans/spans_cls.h>
 
 #ifndef lint
-__RCSID("@(#) $Id: spans_cls.c,v 1.1 1998/09/15 08:23:03 phk Exp $");
+__RCSID("@(#) $Id: spans_cls.c,v 1.2 1998/10/31 20:06:56 phk Exp $");
 #endif
 
 
@@ -842,7 +842,7 @@ spanscls_pdu_print(clp, m, msg)
 {
 	char		buf[128];
 
-	sprintf(buf, "spanscls %s:\n", msg);
+	snprintf(buf, sizeof(buf), "spanscls %s:\n", msg);
 	atm_pdu_print(m, buf);
 }
 
diff --git a/sys/netatm/spans/spans_if.c b/sys/netatm/spans/spans_if.c
index e03f36b..4557f26 100644
--- a/sys/netatm/spans/spans_if.c
+++ b/sys/netatm/spans/spans_if.c
@@ -23,7 +23,7 @@
  * Copies of this Software may be made, however, the above copyright
  * notice must be reproduced on all copies.
  *
- *	@(#) $Id: spans_if.c,v 1.2 1998/09/17 09:35:00 phk Exp $
+ *	@(#) $Id: spans_if.c,v 1.3 1998/10/31 20:06:56 phk Exp $
  *
  */
 
@@ -46,7 +46,7 @@
 #include <netatm/spans/spans_var.h>
 
 #ifndef lint
-__RCSID("@(#) $Id: spans_if.c,v 1.2 1998/09/17 09:35:00 phk Exp $");
+__RCSID("@(#) $Id: spans_if.c,v 1.3 1998/10/31 20:06:56 phk Exp $");
 #endif
 
 /*
@@ -972,7 +972,8 @@ spans_ioctl(code, data, arg1)
 			/*
 			 * Fill out the response struct for the VCC
 			 */
-			(void) sprintf(rsp.avp_intf, "%s%d",
+			(void) snprintf(rsp.avp_intf,
+				    sizeof(rsp.avp_intf), "%s%d",
 					spp->sp_pif->pif_name,
 					spp->sp_pif->pif_unit);
 			rsp.avp_vpi = svp->sv_vpi;
diff --git a/sys/netatm/spans/spans_print.c b/sys/netatm/spans/spans_print.c
index 96e963b..99e8c94 100644
--- a/sys/netatm/spans/spans_print.c
+++ b/sys/netatm/spans/spans_print.c
@@ -23,7 +23,7 @@
  * Copies of this Software may be made, however, the above copyright
  * notice must be reproduced on all copies.
  *
- *	@(#) $Id: spans_print.c,v 1.2 1998/09/17 09:35:00 phk Exp $
+ *	@(#) $Id: spans_print.c,v 1.3 1998/10/31 20:06:56 phk Exp $
  *
  */
 
@@ -41,7 +41,7 @@
 #include <netatm/spans/spans_var.h>
 
 #ifndef lint
-__RCSID("@(#) $Id: spans_print.c,v 1.2 1998/09/17 09:35:00 phk Exp $");
+__RCSID("@(#) $Id: spans_print.c,v 1.3 1998/10/31 20:06:56 phk Exp $");
 #endif
 
 /*
@@ -54,17 +54,17 @@ __RCSID("@(#) $Id: spans_print.c,v 1.2 1998/09/17 09:35:00 phk Exp $");
 /*
  * Local functions
  */
-static void	spans_msgtype_str __P((spans_msgtype *, char *));
+static void	spans_msgtype_str __P((spans_msgtype *, char *, int));
 static void	spans_print_msgbody __P((spans_msgbody *));
-static void	spans_result_str __P((spans_result *, char *));
+static void	spans_result_str __P((spans_result *, char *, int));
 
 #ifdef LONGPRINT
 
 static void	inc_indent __P((void));
 static void	dec_indent __P((void));
-static void	spans_aal_str __P((spans_aal *, char *));
-static void	spans_query_type_str __P((spans_query_type *, char *));
-static void	spans_state_str __P((spans_query_type *, char *));
+static void	spans_aal_str __P((spans_aal *, char *, int));
+static void	spans_query_type_str __P((spans_query_type *, char *, int));
+static void	spans_state_str __P((spans_query_type *, char *, int));
 static void	spans_print_version __P((spans_version *));
 static void	spans_print_vpvc __P((spans_vpvc *));
 static void	spans_print_vpvc_pref __P((spans_vpvc_pref *));
@@ -132,9 +132,10 @@ dec_indent()
 }
 
 static void
-spans_aal_str(objp, dest)
+spans_aal_str(objp, dest, len)
 	spans_aal *objp;
 	char *dest;
+	int len;
 {
 	static char	*aal_names[] = {
 		"SPANS_AAL0",
@@ -146,9 +147,9 @@ spans_aal_str(objp, dest)
 	};
 
 	if (*objp < SPANS_AAL0 || *objp > SPANS_AAL5) {
-		sprintf(dest, "Invalid (%d)", (int)*objp);
+		snprintf(dest, len, "Invalid (%d)", (int)*objp);
 	} else {
-		sprintf(dest, "%s (%d)", aal_names[(int)*objp],
+		snprintf(dest, len, "%s (%d)", aal_names[(int)*objp],
 				(int)*objp);
 	}
 }
@@ -156,9 +157,10 @@ spans_aal_str(objp, dest)
 #endif 
 
 static void
-spans_result_str(objp, dest)
+spans_result_str(objp, dest, len)
 	spans_result *objp;
 	char *dest;
+	int len;
 {
 	static char	*result_names[] = {
 		"SPANS_OK",
@@ -169,17 +171,18 @@ spans_result_str(objp, dest)
 	};
 
 	if (*objp < SPANS_OK || *objp > SPANS_BADDEST) {
-		sprintf(dest, "Invalid (%d)", (int)*objp);
+		snprintf(dest, len, "Invalid (%d)", (int)*objp);
 	} else {
-		sprintf(dest, "%s (%d)",
+		snprintf(dest, len, "%s (%d)",
 				result_names[(int)*objp], (int)*objp);
 	}
 }
 
 static void
-spans_msgtype_str(objp, dest)
+spans_msgtype_str(objp, dest, len)
 	spans_msgtype *objp;
 	char *dest;
+	int len;
 {
 	int	i;
 
@@ -225,7 +228,7 @@ spans_msgtype_str(objp, dest)
 	 */
 	for (i=0; msgtype_names[i].name; i++) {
 		if (*objp == msgtype_names[i].type) {
-			sprintf(dest, "%s (%d)",
+			snprintf(dest, len, "%s (%d)",
 					msgtype_names[i].name,
 					(int)*objp);
 			return;
@@ -235,15 +238,16 @@ spans_msgtype_str(objp, dest)
 	/*
 	 * Type was not found--return an error indicator
 	 */
-	sprintf(dest, "Invalid (%d)", (int)*objp);
+	snprintf(dest, len, "Invalid (%d)", (int)*objp);
 }
 
 #ifdef LONGPRINT 
 
 static void
-spans_query_type_str(objp, dest)
+spans_query_type_str(objp, dest, len)
 	spans_query_type *objp;
 	char *dest;
+	int len;
 {
 	static char	*query_names[] = {
 		"SPANS_QUERY_NORMAL",
@@ -253,17 +257,18 @@ spans_query_type_str(objp, dest)
 
 	if (*objp < SPANS_QUERY_NORMAL ||
 			*objp > SPANS_QUERY_END_TO_END) {
-		sprintf(dest, "Invalid (%d)", (int)*objp);
+		snprintf(dest, len, "Invalid (%d)", (int)*objp);
 	} else {
-		sprintf(dest, "%s (%d)", query_names[(int)*objp],
+		snprintf(dest, len, "%s (%d)", query_names[(int)*objp],
 				(int)*objp);
 	}
 }
 
 static void
-spans_state_str(objp, dest)
+spans_state_str(objp, dest, len)
 	spans_query_type *objp;
 	char *dest;
+	int len;
 {
 	static char	*state_names[] = {
 		"SPANS_CONN_OPEN",
@@ -273,9 +278,9 @@ spans_state_str(objp, dest)
 	};
 
 	if (*objp < SPANS_CONN_OPEN || *objp > SPANS_CONN_CLOSED) {
-		sprintf(dest, "Invalid (%d)", (int)*objp);
+		snprintf(dest, len, "Invalid (%d)", (int)*objp);
 	} else {
-		sprintf(dest, "%s (%d)", state_names[(int)*objp],
+		snprintf(dest, len, "%s (%d)", state_names[(int)*objp],
 				(int)*objp);
 	}
 }
@@ -357,7 +362,7 @@ spans_print_aal(objp)
 {
 	char		aal_str[80];
 
-	spans_aal_str(objp, aal_str);
+	spans_aal_str(objp, aal_str, sizeof(aal_str));
 	printf("%sspans_aal            %s\n", spans_indent, aal_str);
 }
 
@@ -367,7 +372,7 @@ spans_print_result(objp)
 {
 	char		result_str[80];
 
-	spans_result_str(objp, result_str);
+	spans_result_str(objp, result_str, sizeof(result_str));
 	printf("%sspans_result         %s\n", spans_indent, result_str);
 }
 
@@ -377,7 +382,7 @@ spans_print_msgtype(objp)
 {
 	char		msgtype_str[80];
 
-	spans_msgtype_str(objp, msgtype_str);
+	spans_msgtype_str(objp, msgtype_str, sizeof(msgtype_str));
 	printf("%sspans_msgtype        %s\n", spans_indent, msgtype_str);
 }
 
@@ -717,7 +722,8 @@ spans_print_parm_query_req(objp)
 	printf("%sspans_parm_query_req\n", spans_indent);
 	inc_indent();
 	spans_print_atm_conn(&objp->qyreq_conn);
-	spans_query_type_str(&objp->qyreq_type, query_type_str);
+	spans_query_type_str(&objp->qyreq_type,
+		query_type_str, sizeof(query_type_str));
 	printf("%sqyreq_type           %s\n", spans_indent, query_type_str);
 	dec_indent();
 }
@@ -731,9 +737,11 @@ spans_print_parm_query_rsp(objp)
 	printf("%sspans_parm_query_rsp\n", spans_indent);
 	inc_indent();
 	spans_print_atm_conn(&objp->qyrsp_conn);
-	spans_query_type_str(&objp->qyrsp_type, query_type_str);
+	spans_query_type_str(&objp->qyrsp_type,
+		query_type_str, sizeof(query_type_str));
 	printf("%sqyrsp_type           %s\n", spans_indent, query_type_str);
-	spans_state_str(&objp->qyrsp_state, state_type_str);
+	spans_state_str(&objp->qyrsp_state,
+		state_type_str, sizeof(state_type_str));
 	printf("%sqyrsp_state          %s\n", spans_indent, state_type_str);
 	printf("%sqyrsp_data           0x%x\n", spans_indent,
 			objp->qyrsp_data);
@@ -877,7 +885,7 @@ spans_print_msgbody(objp)
 	spans_parm_rclose_rsp	*rcrsp_p;
 	spans_parm_rclose_cnf	*rccnf_p;
 
-	spans_msgtype_str(&objp->mb_type, msgtype_str);
+	spans_msgtype_str(&objp->mb_type, msgtype_str, sizeof(msgtype_str));
 	printf("%s: ", msgtype_str);
 	switch (objp->mb_type) {
 	case SPANS_STAT_REQ:
@@ -889,7 +897,7 @@ spans_print_msgbody(objp)
 		strncpy(daddr, spans_addr_print(&stind_p->stind_es_addr),
 				sizeof(daddr));
 		strncpy(saddr, spans_addr_print(&stind_p->stind_sw_addr),
-				sizeof(daddr));
+				sizeof(saddr));
 		printf("sw_epoch=0x%lx, es_addr=%s, sw_addr=0x%s",
 				stind_p->stind_sw_epoch,
 				daddr, saddr);
@@ -939,7 +947,8 @@ spans_print_msgbody(objp)
 				sizeof(daddr));
 		strncpy(saddr, spans_addr_print(&oprsp_p->oprsp_conn.con_src),
 				sizeof(saddr));
-		spans_result_str(&oprsp_p->oprsp_result, result_str);
+		spans_result_str(&oprsp_p->oprsp_result, result_str,
+			sizeof(result_str));
 		printf("result=%s, daddr=%s, saddr=%s, dsap=%d, ssap=%d, vp.vc=%d.%d",
 				result_str, daddr, saddr,
 				oprsp_p->oprsp_conn.con_dsap,
@@ -953,7 +962,8 @@ spans_print_msgbody(objp)
 				sizeof(daddr));
 		strncpy(saddr, spans_addr_print(&opcnf_p->opcnf_conn.con_src),
 				sizeof(saddr));
-		spans_result_str(&opcnf_p->opcnf_result, result_str);
+		spans_result_str(&opcnf_p->opcnf_result, result_str,
+			sizeof(result_str));
 		printf("result=%s, daddr=%s, saddr=%s, dsap=%d, ssap=%d, vp.vc=%d.%d",
 				result_str, daddr, saddr,
 				opcnf_p->opcnf_conn.con_dsap,
@@ -989,7 +999,8 @@ spans_print_msgbody(objp)
 				sizeof(daddr));
 		strncpy(saddr, spans_addr_print(&clrsp_p->clrsp_conn.con_src),
 				sizeof(saddr));
-		spans_result_str(&clrsp_p->clrsp_result, result_str);
+		spans_result_str(&clrsp_p->clrsp_result, result_str,
+			sizeof(result_str));
 		printf("result=%s, daddr=%s, saddr=%s, dsap=%d, ssap=%d",
 				result_str, daddr, saddr,
 				clrsp_p->clrsp_conn.con_dsap,
@@ -1001,7 +1012,8 @@ spans_print_msgbody(objp)
 				sizeof(daddr));
 		strncpy(saddr, spans_addr_print(&clcnf_p->clcnf_conn.con_src),
 				sizeof(saddr));
-		spans_result_str(&clcnf_p->clcnf_result, result_str);
+		spans_result_str(&clcnf_p->clcnf_result, result_str,
+			sizeof(result_str));
 		printf("result=%s, daddr=%s, saddr=%s, dsap=%d, ssap=%d",
 				result_str, daddr, saddr,
 				clcnf_p->clcnf_conn.con_dsap,
@@ -1035,7 +1047,8 @@ spans_print_msgbody(objp)
 				sizeof(daddr));
 		strncpy(saddr, spans_addr_print(&rcrsp_p->rcrsp_conn.con_src),
 				sizeof(saddr));
-		spans_result_str(&rcrsp_p->rcrsp_result, result_str);
+		spans_result_str(&rcrsp_p->rcrsp_result, result_str,
+			sizeof(result_str));
 		printf("result=%s, daddr=%s, saddr=%s, dsap=%d, ssap=%d",
 				result_str, daddr, saddr,
 				rcrsp_p->rcrsp_conn.con_dsap,
@@ -1047,7 +1060,8 @@ spans_print_msgbody(objp)
 				sizeof(daddr));
 		strncpy(saddr, spans_addr_print(&rccnf_p->rccnf_conn.con_src),
 				sizeof(saddr));
-		spans_result_str(&rccnf_p->rccnf_result, result_str);
+		spans_result_str(&rccnf_p->rccnf_result, result_str,
+			sizeof(result_str));
 		printf("result=%s, daddr=%s, saddr=%s, dsap=%d, ssap=%d",
 				result_str, daddr, saddr,
 				rccnf_p->rccnf_conn.con_dsap,