1 files changed, 16 insertions, 14 deletions

diff --git a/contrib/amd/mk-amd-map/mk-amd-map.c b/contrib/amd/mk-amd-map/mk-amd-map.c
index a9ae965..48d82b0 100644
--- a/contrib/amd/mk-amd-map/mk-amd-map.c
+++ b/contrib/amd/mk-amd-map/mk-amd-map.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1997-2004 Erez Zadok
+ * Copyright (c) 1997-2006 Erez Zadok
  * Copyright (c) 1990 Jan-Simon Pendry
  * Copyright (c) 1990 Imperial College of Science, Technology & Medicine
  * Copyright (c) 1990 The Regents of the University of California.
@@ -36,9 +36,8 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- *      %W% (Berkeley) %G%
  *
- * $Id: mk-amd-map.c,v 1.5.2.6 2004/01/06 03:15:25 ezk Exp $
+ * File: am-utils/mk-amd-map/mk-amd-map.c
  */
 
 /*
@@ -223,7 +222,7 @@ main(int argc, char *argv[])
   char maptpag[16], maptdir[16];
   char *map_name_pag = (char *) NULL, *map_name_dir = (char *) NULL;
 #endif /* not HAVE_DB_SUFFIX */
-  int len;
+  size_t l = 0;
   char *sl;
   int printit = 0;
   int usage = 0;
@@ -272,13 +271,14 @@ main(int argc, char *argv[])
 #endif /* DEBUG */
 
   if (!printit) {
-    len = strlen(mapsrc);
+    /* enough space for ".db" or ".pag" or ".dir" appended */
+    l = strlen(mapsrc) + 5;
 #ifdef HAVE_DB_SUFFIX
-    map_name_db = (char *) malloc(len + 4);
+    map_name_db = (char *) malloc(l);
     error = (map_name_db == NULL);
 #else /* not HAVE_DB_SUFFIX */
-    map_name_pag = (char *) malloc(len + 5);
-    map_name_dir = (char *) malloc(len + 5);
+    map_name_pag = (char *) malloc(l);
+    map_name_dir = (char *) malloc(l);
     error = (map_name_pag == NULL || map_name_dir == NULL);
 #endif /* not HAVE_DB_SUFFIX */
     if (error) {
@@ -305,15 +305,15 @@ main(int argc, char *argv[])
 
     /* remove existing temps (if any) */
 #ifdef HAVE_DB_SUFFIX
-    sprintf(maptdb, "%s.db", maptmp);
+    xsnprintf(maptdb, sizeof(maptdb), "%s.db", maptmp);
     if (remove_file(maptdb) < 0) {
       fprintf(stderr, "Can't remove existing temporary file; ");
       perror(maptdb);
       exit(1);
     }
 #else /* not HAVE_DB_SUFFIX */
-    sprintf(maptpag, "%s.pag", maptmp);
-    sprintf(maptdir, "%s.dir", maptmp);
+    xsnprintf(maptpag, sizeof(maptpag), "%s.pag", maptmp);
+    xsnprintf(maptdir, sizeof(maptdir), "%s.dir", maptmp);
     if (remove_file(maptpag) < 0 || remove_file(maptdir) < 0) {
       fprintf(stderr, "Can't remove existing temporary files; %s and ", maptpag);
       perror(maptdir);
@@ -348,7 +348,8 @@ main(int argc, char *argv[])
   /* all went well */
 
 #ifdef HAVE_DB_SUFFIX
-  sprintf(map_name_db, "%s.db", mapsrc);
+  /* sizeof(map_name_db) is malloc'ed above */
+  xsnprintf(map_name_db, l, "%s.db", mapsrc);
   if (rename(maptdb, map_name_db) < 0) {
     fprintf(stderr, "Couldn't rename %s to ", maptdb);
     perror(map_name_db);
@@ -357,8 +358,9 @@ main(int argc, char *argv[])
     exit(1);
   }
 #else /* not HAVE_DB_SUFFIX */
-  sprintf(map_name_pag, "%s.pag", mapsrc);
-  sprintf(map_name_dir, "%s.dir", mapsrc);
+  /* sizeof(map_name_{pag,dir}) are malloc'ed above */
+  xsnprintf(map_name_pag, l, "%s.pag", mapsrc);
+  xsnprintf(map_name_dir, l, "%s.dir", mapsrc);
   if (rename(maptpag, map_name_pag) < 0) {
     fprintf(stderr, "Couldn't rename %s to ", maptpag);
     perror(map_name_pag);