Eliminate use of strcpy/strcat/sprintf in wconfig.c. Use memcpy since

we cannot rely on libkrb5support to give us the good stuff.  Also fix
up (to some extent) an assumption that size_t == int.

ticket: 6200
status: open

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@20930 dc483132-0cff-0310-8789-dd5450dbe970

1 files changed, 33 insertions, 20 deletions

diff --git a/src/wconfig.c b/src/wconfig.c
index a2ec5b0056..27531b8e23 100644
--- a/src/wconfig.c
+++ b/src/wconfig.c
@@ -57,9 +57,10 @@ int main(int argc, char *argv[])
 {
 	char *ignore_str = "--ignore=";
 	int ignore_len;
-	char *cp, tmp[80];
+	char *cp, *tmp;
 	char *win_flag;
 	char wflags[1024];
+	size_t wlen, alen;
 
 #ifdef _WIN32
 	win_flag = win32_flag;
@@ -67,21 +68,22 @@ int main(int argc, char *argv[])
 	win_flag = "UNIX##";
 #endif
 
-	wflags[0] = 0;
+	wlen = 0;
 
 	ignore_len = strlen(ignore_str);
 	argc--; argv++;
 	while (*argv && *argv[0] == '-') {
-		wflags[sizeof(wflags) - 1] = '\0';
-		if (strlen (wflags) + 1 + strlen (*argv) > sizeof (wflags) - 1) {
+		alen = strlen(*argv);
+		if (wlen + 1 + alen > sizeof (wflags) - 1) {
 			fprintf (stderr,
-				 "wconfig: argument list too long (internal limit %d)",
-				 sizeof (wflags));
+				 "wconfig: argument list too long (internal limit %lu)",
+				 (unsigned long) sizeof (wflags));
 			exit (1);
 		}
-		if (wflags[0])
-			strcat(wflags, " ");
-		strcat(wflags, *argv);
+		if (wlen > 0)
+			wflags[wlen++] = ' ';
+		memcpy(&wflags[wlen], *argv, alen);
+		wlen += alen;
 
 		if (!strcmp(*argv, "--mit")) {
 			mit_specific = 1;
@@ -99,18 +101,19 @@ int main(int argc, char *argv[])
 			continue;
 		}
 		if (!strncmp(*argv, "--enable-", 9)) {
-			sprintf(tmp, "%s##", (*argv)+ignore_len);
-			for (cp = tmp; *cp; cp++) {
-				if (islower(*cp))
-					*cp = toupper(*cp);
-			}
-			cp = strdup(tmp);
-			if (!cp) {
+			tmp = malloc(alen - ignore_len + 3);
+			if (!tmp) {
 				fprintf(stderr,
 					"wconfig: malloc failed!\n");
 				exit(1);
 			}
-			add_ignore_list(cp);
+			memcpy(tmp, *argv + ignore_len, alen - ignore_len);
+			memcpy(tmp + alen - ignore_len, "##", 3);
+			for (cp = tmp; *cp; cp++) {
+				if (islower(*cp))
+					*cp = toupper(*cp);
+			}
+			add_ignore_list(tmp);
 			argc--; argv++;
 			continue;
 		}
@@ -122,6 +125,7 @@ int main(int argc, char *argv[])
 		fprintf(stderr, "Invalid option: %s\n", *argv);
 		exit(1);
 	}
+	wflags[wlen] = '\0';
 
 	if (win_flag)
 		add_ignore_list(win_flag);
@@ -174,16 +178,25 @@ copy_file (char *path, char *fname)
     FILE *fin;
     char buf[1024];
     char **cpp, *ptr;
-    int len;
+    size_t len, plen, flen;
 
     if (strcmp(fname, "-") == 0) {
 	    fin = stdin;
     } else {
+	    plen = strlen(path);
+	    flen = strlen(fname);
+	    if (plen + 1 + flen > sizeof(buf) - 1) {
+		    fprintf(stderr, "Name %s or %s too long", path, fname);
+		    return 1;
+	    }
+	    memcpy(buf, path, plen);
 #ifdef _WIN32
-	    sprintf(buf, "%s\\%s", path, fname);
+	    buf[plen] = '\\';
 #else
-	    sprintf(buf, "%s/%s", path, fname);
+	    buf[plen] = '/';
 #endif
+	    memcpy(buf + plen + 1, fname, flen);
+	    buf[plen + 1 + flen] = '\0';
 	    fin = fopen (buf, "r");                     /* File to read */
 	    if (fin == NULL) {
 		    fprintf(stderr, "wconfig: Can't open file %s\n", buf);