From 1efdc354264822c8805c1d43784c93ba28fc14f0 Mon Sep 17 00:00:00 2001 From: tjr Date: Sun, 23 Feb 2003 07:37:47 +0000 Subject: Fix two unsafe uses of sprintf(). --- sbin/gbde/gbde.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) (limited to 'sbin/gbde') diff --git a/sbin/gbde/gbde.c b/sbin/gbde/gbde.c index 5fbab19..4e6dd26 100644 --- a/sbin/gbde/gbde.c +++ b/sbin/gbde/gbde.c @@ -491,7 +491,9 @@ cmd_init(struct g_bde_key *gl, int dfd, const char *f_opt, int i_opt, const char p = getenv("EDITOR"); if (p == NULL) p = "vi"; - sprintf(cbuf, "%s %s\n", p, q); + if (snprintf(cbuf, sizeof(cbuf), "%s %s\n", p, q) >= + (ssize_t)sizeof(cbuf)) + errx(1, "EDITOR is too long"); system(cbuf); } i = open(q, O_RDONLY); @@ -749,8 +751,11 @@ main(int argc, char **argv) if (doopen) { dfd = open(dest, O_RDWR | O_CREAT, 0644); if (dfd < 0) { - sprintf(buf, "%s%s", _PATH_DEV, dest); - dfd = open(buf, O_RDWR | O_CREAT, 0644); + if (snprintf(buf, sizeof(buf), "%s%s", + _PATH_DEV, dest) >= (ssize_t)sizeof(buf)) + errno = ENAMETOOLONG; + else + dfd = open(buf, O_RDWR | O_CREAT, 0644); } if (dfd < 0) err(1, "%s", dest); -- cgit v1.1