*: remove more sprintf()

Should be just a couple non-development, non-test occurrences of this
function left now.

Signed-off-by: Quentin Young <qlyoung@qlyoung.net>

diff --git a/bgpd/bgp_mpath.c b/bgpd/bgp_mpath.c
index ff5cfe05fbe80c53e544c3a489b31ecb96b83e06..37639f4bce7c181afb5a7b2209d0e29db57d3f1a 100644 (file)
--- a/bgpd/bgp_mpath.c
+++ b/bgpd/bgp_mpath.c
@@ -616,7 +616,8 @@ void bgp_path_info_mpath_update(struct bgp_dest *dest,
                                        all_paths_lb = false;
                                if (debug) {
                                        bgp_path_info_path_with_addpath_rx_str(
-                                               cur_mpath, path_buf);
+                                               cur_mpath, path_buf,
+                                               sizeof(path_buf));
                                        zlog_debug(
                                                "%pRN: %s is still multipath, cur count %d",
                                                bgp_dest_to_rnode(dest),
@@ -626,7 +627,8 @@ void bgp_path_info_mpath_update(struct bgp_dest *dest,
                                mpath_changed = 1;
                                if (debug) {
                                        bgp_path_info_path_with_addpath_rx_str(
-                                               cur_mpath, path_buf);
+                                               cur_mpath, path_buf,
+                                               sizeof(path_buf));
                                        zlog_debug(
                                                "%pRN: remove mpath %s nexthop %s, cur count %d",
                                                bgp_dest_to_rnode(dest),
@@ -660,7 +662,7 @@ void bgp_path_info_mpath_update(struct bgp_dest *dest,
                        mpath_changed = 1;
                        if (debug) {
                                bgp_path_info_path_with_addpath_rx_str(
-                                       cur_mpath, path_buf);
+                                       cur_mpath, path_buf, sizeof(path_buf));
                                zlog_debug(
                                        "%pRN: remove mpath %s nexthop %s, cur count %d",
                                        bgp_dest_to_rnode(dest), path_buf,
@@ -710,7 +712,8 @@ void bgp_path_info_mpath_update(struct bgp_dest *dest,
                                        all_paths_lb = false;
                                if (debug) {
                                        bgp_path_info_path_with_addpath_rx_str(
-                                               new_mpath, path_buf);
+                                               new_mpath, path_buf,
+                                               sizeof(path_buf));
                                        zlog_debug(
                                                "%pRN: add mpath %s nexthop %s, cur count %d",
                                                bgp_dest_to_rnode(dest),

diff --git a/bgpd/bgp_route.c b/bgpd/bgp_route.c
index 0ac9a42dc5172b9493aaeb7bb14b89330f532d5f..1953b769d2057301dfb41fd841eb4aaa612dbd7d 100644 (file)
--- a/bgpd/bgp_route.c
+++ b/bgpd/bgp_route.c
@@ -519,13 +519,14 @@ static uint32_t bgp_med_value(struct attr *attr, struct bgp *bgp)
        }
 }
 
-void bgp_path_info_path_with_addpath_rx_str(struct bgp_path_info *pi, char *buf)
+void bgp_path_info_path_with_addpath_rx_str(struct bgp_path_info *pi, char *buf,
+                                           size_t buf_len)
 {
        if (pi->addpath_rx_id)
-               sprintf(buf, "path %s (addpath rxid %d)", pi->peer->host,
-                       pi->addpath_rx_id);
+               snprintf(buf, buf_len, "path %s (addpath rxid %d)",
+                        pi->peer->host, pi->addpath_rx_id);
        else
-               sprintf(buf, "path %s", pi->peer->host);
+               snprintf(buf, buf_len, "path %s", pi->peer->host);
 }
 
 /* Compare two bgp route entity.  If 'new' is preferable over 'exist' return 1.
@@ -576,7 +577,8 @@ static int bgp_path_info_cmp(struct bgp *bgp, struct bgp_path_info *new,
        }
 
        if (debug)
-               bgp_path_info_path_with_addpath_rx_str(new, new_buf);
+               bgp_path_info_path_with_addpath_rx_str(new, new_buf,
+                                                      sizeof(new_buf));
 
        if (exist == NULL) {
                *reason = bgp_path_selection_first;
@@ -587,7 +589,8 @@ static int bgp_path_info_cmp(struct bgp *bgp, struct bgp_path_info *new,
        }
 
        if (debug) {
-               bgp_path_info_path_with_addpath_rx_str(exist, exist_buf);
+               bgp_path_info_path_with_addpath_rx_str(exist, exist_buf,
+                                                      sizeof(exist_buf));
                zlog_debug("%s: Comparing %s flags 0x%x with %s flags 0x%x",
                           pfx_buf, new_buf, new->flags, exist_buf,
                           exist->flags);
@@ -615,10 +618,10 @@ static int bgp_path_info_cmp(struct bgp *bgp, struct bgp_path_info *new,
                                prefix2str(
                                        bgp_dest_get_prefix(new->net), pfx_buf,
                                        sizeof(*pfx_buf) * PREFIX2STR_BUFFER);
-                               bgp_path_info_path_with_addpath_rx_str(new,
-                                                                      new_buf);
                                bgp_path_info_path_with_addpath_rx_str(
-                                       exist, exist_buf);
+                                       new, new_buf, sizeof(new_buf));
+                               bgp_path_info_path_with_addpath_rx_str(
+                                       exist, exist_buf, sizeof(exist_buf));
                        }
 
                        if (newattr->sticky && !existattr->sticky) {
@@ -2342,7 +2345,7 @@ void bgp_best_selection(struct bgp *bgp, struct bgp_dest *dest,
 
                        if (debug) {
                                bgp_path_info_path_with_addpath_rx_str(
-                                       new_select, path_buf);
+                                       new_select, path_buf, sizeof(path_buf));
                                zlog_debug(
                                        "%pBD: %s is the bestpath from AS %u",
                                        dest, path_buf,
@@ -2416,8 +2419,8 @@ void bgp_best_selection(struct bgp *bgp, struct bgp_dest *dest,
         */
        if (debug) {
                if (new_select)
-                       bgp_path_info_path_with_addpath_rx_str(new_select,
-                                                              path_buf);
+                       bgp_path_info_path_with_addpath_rx_str(
+                               new_select, path_buf, sizeof(path_buf));
                else
                        snprintf(path_buf, sizeof(path_buf), "NONE");
                zlog_debug(
@@ -2432,7 +2435,7 @@ void bgp_best_selection(struct bgp *bgp, struct bgp_dest *dest,
 
                        if (debug)
                                bgp_path_info_path_with_addpath_rx_str(
-                                       pi, path_buf);
+                                       pi, path_buf, sizeof(path_buf));
 
                        if (pi == new_select) {
                                if (debug)
@@ -6383,7 +6386,8 @@ DEFPY_YANG (bgp_network, bgp_network_cmd,
                int ret;
 
                ret = netmask_str2prefix_str(address_str, netmask_str,
-                                            addr_prefix_str);
+                                            addr_prefix_str,
+                                            sizeof(addr_prefix_str));
                if (!ret) {
                        vty_out(vty, "%% Inconsistent address and mask\n");
                        return CMD_WARNING_CONFIG_FAILED;
@@ -7774,7 +7778,8 @@ DEFPY_YANG(
        char prefix_buf[PREFIX2STR_BUFFER];
 
        if (addr_str) {
-               if (netmask_str2prefix_str(addr_str, mask_str, prefix_buf)
+               if (netmask_str2prefix_str(addr_str, mask_str, prefix_buf,
+                                          sizeof(prefix_buf))
                    == 0) {
                        vty_out(vty, "%% Inconsistent address and mask\n");
                        return CMD_WARNING_CONFIG_FAILED;
@@ -14291,7 +14296,7 @@ DEFUN (clear_ip_bgp_dampening_address_mask,
        char prefix_str[BUFSIZ];
 
        ret = netmask_str2prefix_str(argv[idx_ipv4]->arg, argv[idx_ipv4_2]->arg,
-                                    prefix_str);
+                                    prefix_str, sizeof(prefix_str));
        if (!ret) {
                vty_out(vty, "%% Inconsistent address and mask\n");
                return CMD_WARNING;

diff --git a/bgpd/bgp_route.h b/bgpd/bgp_route.h
index 1060d2e60da28c01402c995fdaa3cce4e43a0b18..766e5ade92f23ba47d40d193de2f11fbfb7ea10f 100644 (file)
--- a/bgpd/bgp_route.h
+++ b/bgpd/bgp_route.h
@@ -598,7 +598,7 @@ extern void bgp_path_info_set_flag(struct bgp_dest *dest,
 extern void bgp_path_info_unset_flag(struct bgp_dest *dest,
                                     struct bgp_path_info *path, uint32_t flag);
 extern void bgp_path_info_path_with_addpath_rx_str(struct bgp_path_info *pi,
-                                                  char *buf);
+                                                  char *buf, size_t buf_len);
 
 extern int bgp_nlri_parse_ip(struct peer *, struct attr *, struct bgp_nlri *);
 

diff --git a/bgpd/bgp_routemap.c b/bgpd/bgp_routemap.c
index 3dc2cfbd5c413e4df816f12631d59297718ca859..b7f3289ffcd9cb5d2806d22fe66cd0fd7608e803 100644 (file)
--- a/bgpd/bgp_routemap.c
+++ b/bgpd/bgp_routemap.c
@@ -4315,13 +4315,15 @@ DEFUN (match_community,
        int idx_comm_list = 2;
        int ret;
        char *argstr;
+       size_t argstr_len;
 
        if (argc == 4) {
-               argstr = XMALLOC(MTYPE_ROUTE_MAP_COMPILED,
-                                strlen(argv[idx_comm_list]->arg)
-                                        + strlen("exact-match") + 2);
+               argstr_len = strlen(argv[idx_comm_list]->arg)
+                            + strlen("exact-match") + 2;
+               argstr = XMALLOC(MTYPE_ROUTE_MAP_COMPILED, argstr_len);
 
-               sprintf(argstr, "%s exact-match", argv[idx_comm_list]->arg);
+               snprintf(argstr, argstr_len, "%s exact-match",
+                        argv[idx_comm_list]->arg);
        } else
                argstr = argv[idx_comm_list]->arg;
 
@@ -4362,13 +4364,15 @@ DEFUN (match_lcommunity,
        int idx_lcomm_list = 2;
        int ret;
        char *argstr;
+       size_t argstr_len;
 
        if (argc == 4) {
-               argstr = XMALLOC(MTYPE_ROUTE_MAP_COMPILED,
-                               strlen(argv[idx_lcomm_list]->arg)
-                               + strlen("exact-match") + 2);
+               argstr_len = strlen(argv[idx_lcomm_list]->arg)
+                            + strlen("exact-match") + 2;
+               argstr = XMALLOC(MTYPE_ROUTE_MAP_COMPILED, argstr_len);
 
-               sprintf(argstr, "%s exact-match", argv[idx_lcomm_list]->arg);
+               snprintf(argstr, argstr_len, "%s exact-match",
+                        argv[idx_lcomm_list]->arg);
        } else
                argstr = argv[idx_lcomm_list]->arg;
 
@@ -5252,6 +5256,7 @@ DEFUN (set_aggregator_as,
        int ret;
        struct in_addr address;
        char *argstr;
+       size_t argstr_len;
 
        ret = inet_aton(argv[idx_ipv4]->arg, &address);
        if (ret == 0) {
@@ -5259,11 +5264,12 @@ DEFUN (set_aggregator_as,
                return CMD_WARNING_CONFIG_FAILED;
        }
 
-       argstr = XMALLOC(MTYPE_ROUTE_MAP_COMPILED,
-                        strlen(argv[idx_number]->arg)
-                                + strlen(argv[idx_ipv4]->arg) + 2);
+       argstr_len =
+               strlen(argv[idx_number]->arg) + strlen(argv[idx_ipv4]->arg) + 2;
+       argstr = XMALLOC(MTYPE_ROUTE_MAP_COMPILED, argstr_len);
 
-       sprintf(argstr, "%s %s", argv[idx_number]->arg, argv[idx_ipv4]->arg);
+       snprintf(argstr, argstr_len, "%s %s", argv[idx_number]->arg,
+                argv[idx_ipv4]->arg);
 
        ret = generic_set_add(vty, VTY_GET_CONTEXT(route_map_index),
                              "aggregator as", argstr);
@@ -5289,6 +5295,7 @@ DEFUN (no_set_aggregator_as,
        int ret;
        struct in_addr address;
        char *argstr;
+       size_t argstr_len;
 
        if (argc <= idx_asn)
                return generic_set_delete(vty, VTY_GET_CONTEXT(route_map_index),
@@ -5300,11 +5307,11 @@ DEFUN (no_set_aggregator_as,
                return CMD_WARNING_CONFIG_FAILED;
        }
 
-       argstr = XMALLOC(MTYPE_ROUTE_MAP_COMPILED,
-                        strlen(argv[idx_asn]->arg) + strlen(argv[idx_ip]->arg)
-                                + 2);
+       argstr_len = strlen(argv[idx_asn]->arg) + strlen(argv[idx_ip]->arg) + 2;
+       argstr = XMALLOC(MTYPE_ROUTE_MAP_COMPILED, argstr_len);
 
-       sprintf(argstr, "%s %s", argv[idx_asn]->arg, argv[idx_ip]->arg);
+       snprintf(argstr, argstr_len, "%s %s", argv[idx_asn]->arg,
+                argv[idx_ip]->arg);
 
        ret = generic_set_delete(vty, VTY_GET_CONTEXT(route_map_index),
                                 "aggregator as", argstr);

diff --git a/doc/developer/workflow.rst b/doc/developer/workflow.rst
index 861d87b998a62fc17ae16c66c911c62686b1e501..71e2b00448b60bc3f7e5caf484c1e92f9f810971 100644 (file)
--- a/doc/developer/workflow.rst
+++ b/doc/developer/workflow.rst
@@ -563,7 +563,7 @@ In general, code submitted into FRR will be rejected if it uses unsafe
 programming practices.  While there is no enforced overall ruleset, the
 following requirements have achieved consensus:
 
-- ``strcpy``, ``strcat`` and ``sprintf`` are inacceptable without exception.
+- ``strcpy``, ``strcat`` and ``sprintf`` are unacceptable without exception.
   Use ``strlcpy``, ``strlcat`` and ``snprintf`` instead.  (Rationale:  even if
   you know the operation cannot overflow the buffer, a future code change may
   inadvertedly introduce an overflow.)

diff --git a/isisd/isis_lsp.c b/isisd/isis_lsp.c
index 6d2303817b568f7b45b4a7f6d0fbb70f5e0d6dfa..a17d9a6ae2fda31a6e42cd45c085b2d8c49578a5 100644 (file)
--- a/isisd/isis_lsp.c
+++ b/isisd/isis_lsp.c
@@ -691,8 +691,8 @@ static void lsp_set_time(struct isis_lsp *lsp)
                stream_putw_at(lsp->pdu, 10, lsp->hdr.rem_lifetime);
 }
 
-void lspid_print(uint8_t *lsp_id, char *dest, char dynhost, char frag,
-                struct isis *isis)
+void lspid_print(uint8_t *lsp_id, char *dest, size_t dest_len, char dynhost,
+                char frag, struct isis *isis)
 {
        struct isis_dynhn *dyn = NULL;
        char id[SYSID_STRLEN];
@@ -710,10 +710,10 @@ void lspid_print(uint8_t *lsp_id, char *dest, char dynhost, char frag,
                memcpy(id, sysid_print(lsp_id), 15);
 
        if (frag)
-               sprintf(dest, "%s.%02x-%02x", id, LSP_PSEUDO_ID(lsp_id),
-                       LSP_FRAGMENT(lsp_id));
+               snprintf(dest, dest_len, "%s.%02x-%02x", id,
+                        LSP_PSEUDO_ID(lsp_id), LSP_FRAGMENT(lsp_id));
        else
-               sprintf(dest, "%s.%02x", id, LSP_PSEUDO_ID(lsp_id));
+               snprintf(dest, dest_len, "%s.%02x", id, LSP_PSEUDO_ID(lsp_id));
 }
 
 /* Convert the lsp attribute bits to attribute string */
@@ -747,7 +747,7 @@ void lsp_print(struct isis_lsp *lsp, struct vty *vty, char dynhost,
        char age_out[8];
        char b[200];
 
-       lspid_print(lsp->hdr.lsp_id, LSPid, dynhost, 1, isis);
+       lspid_print(lsp->hdr.lsp_id, LSPid, sizeof(LSPid), dynhost, 1, isis);
        vty_out(vty, "%-21s%c  ", LSPid, lsp->own_lsp ? '*' : ' ');
        vty_out(vty, "%5hu   ", lsp->hdr.pdu_len);
        vty_out(vty, "0x%08x  ", lsp->hdr.seqno);

diff --git a/isisd/isis_lsp.h b/isisd/isis_lsp.h
index 0783036e497605679ae75e63c90513e2469d707b..896d9576072cf888407b56ea24cddcf1547c71d9 100644 (file)
--- a/isisd/isis_lsp.h
+++ b/isisd/isis_lsp.h
@@ -116,8 +116,8 @@ void lsp_update(struct isis_lsp *lsp, struct isis_lsp_hdr *hdr,
                struct isis_tlvs *tlvs, struct stream *stream,
                struct isis_area *area, int level, bool confusion);
 void lsp_inc_seqno(struct isis_lsp *lsp, uint32_t seqno);
-void lspid_print(uint8_t *lsp_id, char *dest, char dynhost, char frag,
-                struct isis *isis);
+void lspid_print(uint8_t *lsp_id, char *dest, size_t dest_len, char dynhost,
+                char frag, struct isis *isis);
 void lsp_print(struct isis_lsp *lsp, struct vty *vty, char dynhost,
               struct isis *isis);
 void lsp_print_detail(struct isis_lsp *lsp, struct vty *vty, char dynhost,

diff --git a/isisd/isis_misc.c b/isisd/isis_misc.c
index 6e9cbaf98ead9353316026f43e2135d113ec1828..d3d081d37624c7cc5ec3e4b4b5634c6bd65bcb60 100644 (file)
--- a/isisd/isis_misc.c
+++ b/isisd/isis_misc.c
@@ -59,27 +59,30 @@ char nlpidstring[30];
 const char *isonet_print(const uint8_t *from, int len)
 {
        int i = 0;
-       char *pos = isonet;
+       char tbuf[4];
+       isonet[0] = '\0';
 
        if (!from)
                return "unknown";
 
        while (i < len) {
                if (i & 1) {
-                       sprintf(pos, "%02x", *(from + i));
-                       pos += 2;
+                       snprintf(tbuf, sizeof(tbuf), "%02x", *(from + i));
+                       strlcat(isonet, tbuf, sizeof(isonet));
                } else {
                        if (i == (len - 1)) { /* No dot at the end of address */
-                               sprintf(pos, "%02x", *(from + i));
-                               pos += 2;
+                               snprintf(tbuf, sizeof(tbuf), "%02x",
+                                        *(from + i));
+                               strlcat(isonet, tbuf, sizeof(isonet));
                        } else {
-                               sprintf(pos, "%02x.", *(from + i));
-                               pos += 3;
+                               snprintf(tbuf, sizeof(tbuf), "%02x.",
+                                        *(from + i));
+                               strlcat(isonet, tbuf, sizeof(isonet));
                        }
                }
                i++;
        }
-       *(pos) = '\0';
+
        return isonet;
 }
 
@@ -202,17 +205,18 @@ const char *nlpid2str(uint8_t nlpid)
 
 char *nlpid2string(struct nlpids *nlpids)
 {
-       char *pos = nlpidstring;
        int i;
+       char tbuf[256];
+       nlpidstring[0] = '\0';
 
        for (i = 0; i < nlpids->count; i++) {
-               pos += sprintf(pos, "%s", nlpid2str(nlpids->nlpids[i]));
+               snprintf(tbuf, sizeof(tbuf), "%s",
+                        nlpid2str(nlpids->nlpids[i]));
+               strlcat(nlpidstring, tbuf, sizeof(nlpidstring));
                if (nlpids->count - i > 1)
-                       pos += sprintf(pos, ", ");
+                       strlcat(nlpidstring, ", ", sizeof(nlpidstring));
        }
 
-       *(pos) = '\0';
-
        return nlpidstring;
 }
 
@@ -359,34 +363,47 @@ const char *isis_format_id(const uint8_t *id, size_t len)
 
 const char *time2string(uint32_t time)
 {
-       char *pos = datestring;
        uint32_t rest;
+       char tbuf[32];
+       datestring[0] = '\0';
 
        if (time == 0)
                return "-";
 
-       if (time / SECS_PER_YEAR)
-               pos += sprintf(pos, "%uY", time / SECS_PER_YEAR);
+       if (time / SECS_PER_YEAR) {
+               snprintf(tbuf, sizeof(tbuf), "%uY", time / SECS_PER_YEAR);
+               strlcat(datestring, tbuf, sizeof(datestring));
+       }
        rest = time % SECS_PER_YEAR;
-       if (rest / SECS_PER_MONTH)
-               pos += sprintf(pos, "%uM", rest / SECS_PER_MONTH);
+       if (rest / SECS_PER_MONTH) {
+               snprintf(tbuf, sizeof(tbuf), "%uM", rest / SECS_PER_MONTH);
+               strlcat(datestring, tbuf, sizeof(datestring));
+       }
        rest = rest % SECS_PER_MONTH;
-       if (rest / SECS_PER_WEEK)
-               pos += sprintf(pos, "%uw", rest / SECS_PER_WEEK);
+       if (rest / SECS_PER_WEEK) {
+               snprintf(tbuf, sizeof(tbuf), "%uw", rest / SECS_PER_WEEK);
+               strlcat(datestring, tbuf, sizeof(datestring));
+       }
        rest = rest % SECS_PER_WEEK;
-       if (rest / SECS_PER_DAY)
-               pos += sprintf(pos, "%ud", rest / SECS_PER_DAY);
+       if (rest / SECS_PER_DAY) {
+               snprintf(tbuf, sizeof(tbuf), "%ud", rest / SECS_PER_DAY);
+               strlcat(datestring, tbuf, sizeof(datestring));
+       }
        rest = rest % SECS_PER_DAY;
-       if (rest / SECS_PER_HOUR)
-               pos += sprintf(pos, "%uh", rest / SECS_PER_HOUR);
+       if (rest / SECS_PER_HOUR) {
+               snprintf(tbuf, sizeof(tbuf), "%uh", rest / SECS_PER_HOUR);
+               strlcat(datestring, tbuf, sizeof(datestring));
+       }
        rest = rest % SECS_PER_HOUR;
-       if (rest / SECS_PER_MINUTE)
-               pos += sprintf(pos, "%um", rest / SECS_PER_MINUTE);
+       if (rest / SECS_PER_MINUTE) {
+               snprintf(tbuf, sizeof(tbuf), "%um", rest / SECS_PER_MINUTE);
+               strlcat(datestring, tbuf, sizeof(datestring));
+       }
        rest = rest % SECS_PER_MINUTE;
-       if (rest)
-               pos += sprintf(pos, "%us", rest);
-
-       *(pos) = 0;
+       if (rest) {
+               snprintf(tbuf, sizeof(tbuf), "%us", rest);
+               strlcat(datestring, tbuf, sizeof(datestring));
+       }
 
        return datestring;
 }

diff --git a/isisd/isis_vty_fabricd.c b/isisd/isis_vty_fabricd.c
index d0a411a8db5ac3024455c1a9279aeaab09a5c088..60559841952e01e19988367770c275c15cb61f09 100644 (file)
--- a/isisd/isis_vty_fabricd.c
+++ b/isisd/isis_vty_fabricd.c
@@ -118,7 +118,7 @@ static void lsp_print_flooding(struct vty *vty, struct isis_lsp *lsp,
        char lspid[255];
        char buf[MONOTIME_STRLEN];
 
-       lspid_print(lsp->hdr.lsp_id, lspid, true, true, isis);
+       lspid_print(lsp->hdr.lsp_id, lspid, sizeof(lspid), true, true, isis);
        vty_out(vty, "Flooding information for %s\n", lspid);
 
        if (!lsp->flooding_neighbors[TX_LSP_NORMAL]) {

diff --git a/lib/prefix.c b/lib/prefix.c
index 663a87afde26c1c7cb2e64de6477cb24f94fa662..c98e0c1c7239faf192b60ff647a439e2828a5ec9 100644 (file)
--- a/lib/prefix.c
+++ b/lib/prefix.c
@@ -1160,7 +1160,7 @@ in_addr_t ipv4_broadcast_addr(in_addr_t hostaddr, int masklen)
    ex.) "1.1.0.0" "255.255.0.0" => "1.1.0.0/16"
    ex.) "1.0.0.0" NULL => "1.0.0.0/8"                   */
 int netmask_str2prefix_str(const char *net_str, const char *mask_str,
-                          char *prefix_str)
+                          char *prefix_str, size_t prefix_str_len)
 {
        struct in_addr network;
        struct in_addr mask;
@@ -1193,7 +1193,7 @@ int netmask_str2prefix_str(const char *net_str, const char *mask_str,
                        return 0;
        }
 
-       sprintf(prefix_str, "%s/%d", net_str, prefixlen);
+       snprintf(prefix_str, prefix_str_len, "%s/%d", net_str, prefixlen);
 
        return 1;
 }

diff --git a/lib/prefix.h b/lib/prefix.h
index b7fdc263694f5920384495340e25764d11d9917c..b2f3b0592f98982857c08145dab0453b9deaca50 100644 (file)
--- a/lib/prefix.h
+++ b/lib/prefix.h
@@ -491,7 +491,7 @@ extern void masklen2ip(const int, struct in_addr *);
  * special treatment for /31 according to RFC3021 section 3.3 */
 extern in_addr_t ipv4_broadcast_addr(in_addr_t hostaddr, int masklen);
 
-extern int netmask_str2prefix_str(const char *, const char *, char *);
+extern int netmask_str2prefix_str(const char *, const char *, char *, size_t);
 
 extern struct prefix_ipv6 *prefix_ipv6_new(void);
 extern void prefix_ipv6_free(struct prefix_ipv6 **p);

diff --git a/lib/vty.c b/lib/vty.c
index 4062b183e721178ad22649e2f04ff417aaf24899..66b607861cdf39e0b9cafa0232dad65e9fbf56fc 100644 (file)
--- a/lib/vty.c
+++ b/lib/vty.c
@@ -2414,9 +2414,9 @@ bool vty_read_config(struct nb_config *config, const char *config_file,
                                        __func__, errno);
                                goto tmp_free_and_out;
                        }
-                       tmp = XMALLOC(MTYPE_TMP,
-                                     strlen(cwd) + strlen(config_file) + 2);
-                       sprintf(tmp, "%s/%s", cwd, config_file);
+                       size_t tmp_len = strlen(cwd) + strlen(config_file) + 2;
+                       tmp = XMALLOC(MTYPE_TMP, tmp_len);
+                       snprintf(tmp, tmp_len, "%s/%s", cwd, config_file);
                        fullpath = tmp;
                } else
                        fullpath = config_file;

diff --git a/ospf6d/ospf6_abr.c b/ospf6d/ospf6_abr.c
index 7bd51138b303d80cc55a81f8595ef1663787e270..465f0291f4e8baae7219cc321d30ae823cf4ddeb 100644 (file)
--- a/ospf6d/ospf6_abr.c
+++ b/ospf6d/ospf6_abr.c
@@ -1265,6 +1265,7 @@ static char *ospf6_inter_area_prefix_lsa_get_prefix_str(struct ospf6_lsa *lsa,
 {
        struct ospf6_inter_prefix_lsa *prefix_lsa;
        struct in6_addr in6;
+       char tbuf[16];
 
        if (lsa != NULL) {
                prefix_lsa =
@@ -1274,8 +1275,9 @@ static char *ospf6_inter_area_prefix_lsa_get_prefix_str(struct ospf6_lsa *lsa,
                ospf6_prefix_in6_addr(&in6, prefix_lsa, &prefix_lsa->prefix);
                if (buf) {
                        inet_ntop(AF_INET6, &in6, buf, buflen);
-                       sprintf(&buf[strlen(buf)], "/%d",
-                               prefix_lsa->prefix.prefix_length);
+                       snprintf(tbuf, sizeof(tbuf), "/%d",
+                                prefix_lsa->prefix.prefix_length);
+                       strlcat(buf, tbuf, buflen);
                }
        }
 

diff --git a/ospf6d/ospf6_asbr.c b/ospf6d/ospf6_asbr.c
index 3449f482674fd13ea00c27167b1ba3035d6a73a3..d0c93dd5773e94d5042b6dba612be6f988b374dc 100644 (file)
--- a/ospf6d/ospf6_asbr.c
+++ b/ospf6d/ospf6_asbr.c
@@ -1865,6 +1865,7 @@ static char *ospf6_as_external_lsa_get_prefix_str(struct ospf6_lsa *lsa,
        struct ospf6_as_external_lsa *external;
        struct in6_addr in6;
        int prefix_length = 0;
+       char tbuf[16];
 
        if (lsa) {
                external = (struct ospf6_as_external_lsa *)OSPF6_LSA_HEADER_END(
@@ -1885,9 +1886,11 @@ static char *ospf6_as_external_lsa_get_prefix_str(struct ospf6_lsa *lsa,
                }
                if (buf) {
                        inet_ntop(AF_INET6, &in6, buf, buflen);
-                       if (prefix_length)
-                               sprintf(&buf[strlen(buf)], "/%d",
-                                       prefix_length);
+                       if (prefix_length) {
+                               snprintf(tbuf, sizeof(tbuf), "/%d",
+                                        prefix_length);
+                               strlcat(buf, tbuf, buflen);
+                       }
                }
        }
        return (buf);

diff --git a/ospf6d/ospf6_intra.c b/ospf6d/ospf6_intra.c
index fd154e7ee53e49b5af0c74d9f0bbf70788c9e826..1a81d50b6814e541247b7e00c8c9dd2698ae50e2 100644 (file)
--- a/ospf6d/ospf6_intra.c
+++ b/ospf6d/ospf6_intra.c
@@ -83,7 +83,7 @@ static char *ospf6_router_lsa_get_nbr_id(struct ospf6_lsa *lsa, char *buf,
                                          sizeof(buf1));
                                inet_ntop(AF_INET, &lsdesc->neighbor_router_id,
                                          buf2, sizeof(buf2));
-                               sprintf(buf, "%s/%s", buf2, buf1);
+                               snprintf(buf, buflen, "%s/%s", buf2, buf1);
 
                                return buf;
                        }
@@ -865,6 +865,7 @@ static char *ospf6_intra_prefix_lsa_get_prefix_str(struct ospf6_lsa *lsa,
        struct in6_addr in6;
        int prefixnum, cnt = 0;
        struct ospf6_prefix *prefix;
+       char tbuf[16];
 
        if (lsa) {
                intra_prefix_lsa =
@@ -897,8 +898,9 @@ static char *ospf6_intra_prefix_lsa_get_prefix_str(struct ospf6_lsa *lsa,
                                       OSPF6_PREFIX_SPACE(
                                               prefix->prefix_length));
                                inet_ntop(AF_INET6, &in6, buf, buflen);
-                               sprintf(&buf[strlen(buf)], "/%d",
-                                       prefix->prefix_length);
+                               snprintf(tbuf, sizeof(tbuf), "/%d",
+                                        prefix->prefix_length);
+                               strlcat(buf, tbuf, buflen);
                                return (buf);
                        }
                } while (current <= end);

diff --git a/zebra/irdp_interface.c b/zebra/irdp_interface.c
index 2ab5fd3a4c1d150b8a980c446f0badd3027d686f..5352c6214dde30de289842457923631c03875136 100644 (file)
--- a/zebra/irdp_interface.c
+++ b/zebra/irdp_interface.c
@@ -93,10 +93,10 @@ static int irdp_if_delete(struct interface *ifp)
        return 0;
 }
 
-static const char *inet_2a(uint32_t a, char *b)
+static const char *inet_2a(uint32_t a, char *b, size_t b_len)
 {
-       sprintf(b, "%u.%u.%u.%u", (a)&0xFF, (a >> 8) & 0xFF, (a >> 16) & 0xFF,
-               (a >> 24) & 0xFF);
+       snprintf(b, b_len, "%u.%u.%u.%u", (a)&0xFF, (a >> 8) & 0xFF,
+                (a >> 16) & 0xFF, (a >> 24) & 0xFF);
        return b;
 }
 
@@ -140,7 +140,8 @@ static int if_group(struct interface *ifp, int sock, uint32_t group,
                flog_err_sys(EC_LIB_SOCKET, "IRDP: %s can't setsockopt %s: %s",
                             add_leave == IP_ADD_MEMBERSHIP ? "join group"
                                                            : "leave group",
-                            inet_2a(group, b1), safe_strerror(errno));
+                            inet_2a(group, b1, sizeof(b1)),
+                            safe_strerror(errno));
 
        return ret;
 }
@@ -162,7 +163,8 @@ static int if_add_group(struct interface *ifp)
 
        if (irdp->flags & IF_DEBUG_MISC)
                zlog_debug("IRDP: Adding group %s for %s",
-                          inet_2a(htonl(INADDR_ALLRTRS_GROUP), b1), ifp->name);
+                          inet_2a(htonl(INADDR_ALLRTRS_GROUP), b1, sizeof(b1)),
+                          ifp->name);
        return 0;
 }
 
@@ -183,7 +185,8 @@ static int if_drop_group(struct interface *ifp)
 
        if (irdp->flags & IF_DEBUG_MISC)
                zlog_debug("IRDP: Leaving group %s for %s",
-                          inet_2a(htonl(INADDR_ALLRTRS_GROUP), b1), ifp->name);
+                          inet_2a(htonl(INADDR_ALLRTRS_GROUP), b1, sizeof(b1)),
+                          ifp->name);
        return 0;
 }
 
@@ -383,7 +386,8 @@ int irdp_config_write(struct vty *vty, struct interface *ifp)
 
                for (ALL_LIST_ELEMENTS_RO(irdp->AdvPrefList, node, adv))
                        vty_out(vty, " ip irdp address %s preference %d\n",
-                               inet_2a(adv->ip.s_addr, b1), adv->pref);
+                               inet_2a(adv->ip.s_addr, b1, sizeof(b1)),
+                               adv->pref);
 
                vty_out(vty, " ip irdp holdtime %d\n", irdp->Lifetime);
 

diff --git a/zebra/rt_netlink.c b/zebra/rt_netlink.c
index 3af3586d31886c90db9e5e0d7cc9e3a80c77941d..04b6b379a996260714b61bffb4bc07f9f1f729c6 100644 (file)
--- a/zebra/rt_netlink.c
+++ b/zebra/rt_netlink.c
@@ -1132,8 +1132,8 @@ static int build_label_stack(struct mpls_label_stack *nh_label,
 
                if (IS_ZEBRA_DEBUG_KERNEL) {
                        if (!num_labels)
-                               sprintf(label_buf, "label %u",
-                                       nh_label->label[i]);
+                               snprintf(label_buf, label_buf_size, "label %u",
+                                        nh_label->label[i]);
                        else {
                                snprintf(label_buf1, sizeof(label_buf1), "/%u",
                                         nh_label->label[i]);