Replace sprintf() by snprintf()

bin/konfd.c

@@ -138,6 +138,7 @@ int main(int argc, char **argv)
 		} else {
 			char str[20];
 			snprintf(str, sizeof(str), "%u\n", getpid());
+			str[sizeof(str) - 1] = '\0';
 			if (write(pidfd, str, strlen(str)) < 0)
 				syslog(LOG_WARNING, "Can't write to %s: %s",
 					opts->pidfile, strerror(errno));

clish/ptype/ptype.c

@@ -65,18 +65,18 @@ static void clish_ptype__set_range(clish_ptype_t * this)
 	/*------------------------------------------------- */
 	case CLISH_PTYPE_INTEGER:
 		/* Setup the integer range */
-		sprintf(tmp,
-			"%d..%d",
+		snprintf(tmp, sizeof(tmp), "%d..%d",
 			this->u.integer.min, this->u.integer.max);
+		tmp[sizeof(tmp) - 1] = '\0';
 		this->range = lub_string_dup(tmp);
 		break;
 	/*------------------------------------------------- */
 	case CLISH_PTYPE_UNSIGNEDINTEGER:
 		/* Setup the unsigned integer range */
-		sprintf(tmp,
-			"%u..%u",
+		snprintf(tmp, sizeof(tmp), "%u..%u",
 			(unsigned int)this->u.integer.min,
 			(unsigned int)this->u.integer.max);
+		tmp[sizeof(tmp) - 1] = '\0';
 		this->range = lub_string_dup(tmp);
 		break;
 	/*------------------------------------------------- */
@@ -86,12 +86,12 @@ static void clish_ptype__set_range(clish_ptype_t * this)
 		unsigned int i;
 
 		for (i = 0; i < lub_argv__get_count(this->u.select.items); i++) {
-			char *p = tmp;
 			char *name = clish_ptype_select__get_name(this, i);
 
 			if (i > 0)
-				p += sprintf(p, "/");
-			sprintf(p, "%s", name);
+				lub_string_cat(&this->range, "/");
+			snprintf(tmp, sizeof(tmp), "%s", name);
+			tmp[sizeof(tmp) - 1] = '\0';
 			lub_string_cat(&this->range, tmp);
 			lub_string_free(name);
 		}
@@ -316,7 +316,7 @@ static char *clish_ptype_validate_or_translate(const clish_ptype_t * this,
 		/* first of all check that this is a number */
 		bool_t ok = BOOL_TRUE;
 		const char *p = result;
-		while (*p) {
+		while (p && *p) {
 			if (!lub_ctype_isdigit(*p++)) {
 				ok = BOOL_FALSE;
 				break;

clish/shell/shell_expat.c

@@ -486,14 +486,15 @@ int clish_xmlnode_get_content(clish_xmlnode_t *node, char *content,
 }
 
 int clish_xmlnode_get_name(clish_xmlnode_t *node, char *name,
-			    unsigned int *namelen)
+	unsigned int *namelen)
 {
 	if (node && name && namelen) {
 		if (strlen(node->name) >= *namelen) {
 			*namelen = strlen(node->name) + 1;
 			return -E2BIG;
 		}
-		sprintf(name, "%s", node->name);
+		snprintf(name, *namelen, "%s", node->name);
+		name[*namelen - 1] = '\0';
 		return 0;
 	}
 	return -EINVAL;

clish/shell/shell_libxml2.c

@@ -241,7 +241,8 @@ int clish_xmlnode_get_name(clish_xmlnode_t *node, char *name,
 	rlen = strlen((char*)n->name) + 1;
 	
 	if (rlen <= *namelen) {
-		sprintf(name, "%s", (char*)n->name);
+		snprintf(name, *namelen, "%s", (char*)n->name);
+		name[*namelen - 1] = '\0';
 		return 0;
 	} else {
 		*namelen = rlen;

clish/shell/shell_roxml.c

@@ -275,7 +275,8 @@ static int i_get_name(node_t *n, char *v, unsigned int *vl)
 	if (c) {
 		len = strlen(c) + 1;
 		if (len <= *vl) {
-			sprintf(v, "%s", c);
+			snprintf(v, *vl, "%s", c);
+			v[*vl - 1] = '\0';
 			roxml_release(c);
 			return 0;
 		} else {