Better handling for the return of snprintf().

2 files changed, 12 insertions, 5 deletions

diff --git a/usr.sbin/ppp/command.c b/usr.sbin/ppp/command.c
index 2c79b89..36cd8ed 100644
--- a/usr.sbin/ppp/command.c
+++ b/usr.sbin/ppp/command.c
@@ -255,14 +255,17 @@ HelpCommand(struct cmdargs const *arg)
 static int
 IdentCommand(struct cmdargs const *arg)
 {
-  int f, pos;
+  int f, max, n, pos;
 
   *arg->cx->physical->link.lcp.cfg.ident = '\0';
+  max = sizeof arg->cx->physical->link.lcp.cfg.ident;
 
-  for (pos = 0, f = arg->argn; f < arg->argc; f++)
-    pos += snprintf(arg->cx->physical->link.lcp.cfg.ident + pos,
-                    sizeof arg->cx->physical->link.lcp.cfg.ident - pos, "%s%s",
-                    f == arg->argn ? "" : " ", arg->argv[f]);
+  for (pos = 0, f = arg->argn; f < arg->argc && pos < max; f++) {
+    n = snprintf(arg->cx->physical->link.lcp.cfg.ident + pos, max - pos,
+                 "%s%s", f == arg->argn ? "" : " ", arg->argv[f]);
+    if (n == -1 || (pos += n) >= max)
+      break;
+  }
 
   return 0;
 }
diff --git a/usr.sbin/ppp/mp.c b/usr.sbin/ppp/mp.c
index ac9321b..f288c8d 100644
--- a/usr.sbin/ppp/mp.c
+++ b/usr.sbin/ppp/mp.c
@@ -1124,6 +1124,10 @@ mpserver_Open(struct mpserver *s, struct peerid *peer)
 
   l = snprintf(s->socket.sun_path, sizeof s->socket.sun_path, "%sppp-%s-%02x-",
                _PATH_VARRUN, peer->authname, peer->enddisc.class);
+  if (l < 0) {
+    log_Printf(LogERROR, "mpserver: snprintf(): %s\n", strerror(errno));
+    return MPSERVER_FAILED;
+  }
 
   for (f = 0; f < peer->enddisc.len && l < sizeof s->socket.sun_path - 2; f++) {
     snprintf(s->socket.sun_path + l, sizeof s->socket.sun_path - l,