This is a security audit change of the main source.

It removed all ocurrences of the following functions :

sprintf
strcpy
strcat

The replacements are slprintf, safe_strcpy and safe_strcat.

It should not be possible to use code in Samba that uses
sprintf, strcpy or strcat, only the safe_equivalents.

Once Andrew has fixed the slprintf implementation then
this code will be moved back to the 1.9.18 code stream.

Jeremy.

3 files changed, 10 insertions, 10 deletions

diff --git a/source/rpc_server/srv_netlog.c b/source/rpc_server/srv_netlog.c
index 28c44a57b7e..958f0bf14df 100644
--- a/source/rpc_server/srv_netlog.c
+++ b/source/rpc_server/srv_netlog.c
@@ -279,7 +279,7 @@ static void api_net_req_chal( int uid,
 	fstrcpy(mach_name, mach_acct);
 	strlower(mach_name);
 
-	strcat(mach_acct, "$");
+	fstrcat(mach_acct, "$");
 
 	if (get_md4pw((char *)vuser->dc.md4pw, mach_name, mach_acct))
 	{
diff --git a/source/rpc_server/srv_samr.c b/source/rpc_server/srv_samr.c
index 20cdc30babe..6f834e454a2 100644
--- a/source/rpc_server/srv_samr.c
+++ b/source/rpc_server/srv_samr.c
@@ -231,9 +231,9 @@ static void samr_reply_unknown_3(SAMR_Q_UNKNOWN_3 *q_u,
 
 	if (status == 0x0)
 	{
-		strcpy(user_sid, lp_domain_sid());
-		sprintf(user_rid, "-%x", rid);
-		strcat(user_sid, user_rid);
+		fstrcpy(user_sid, lp_domain_sid());
+		slprintf(user_rid, sizeof(user_rid) - 1, "-%x", rid);
+		fstrcat(user_sid, user_rid);
 
 		/* maybe need another 1 or 2 (S-1-5-20-0x220 and S-1-5-20-0x224) */
 		/* these two are DOMAIN_ADMIN and DOMAIN_ACCT_OP group RIDs */
diff --git a/source/rpc_server/srv_util.c b/source/rpc_server/srv_util.c
index 210a3f55e22..e842e3b9f95 100644
--- a/source/rpc_server/srv_util.c
+++ b/source/rpc_server/srv_util.c
@@ -297,22 +297,22 @@ void get_domain_user_groups(char *domain_groups, char *user)
 	/* can only be a user or a guest.  cannot be guest _and_ admin */
 	if (user_in_list(user, lp_domain_guest_users()))
 	{
-		sprintf(tmp, " %ld/7 ", DOMAIN_GROUP_RID_GUESTS);
-		strcat(domain_groups, tmp);
+		slprintf(tmp, sizeof(tmp) - 1, " %ld/7 ", DOMAIN_GROUP_RID_GUESTS);
+		pstrcat(domain_groups, tmp);
 
 		DEBUG(3,("domain guest access %s granted\n", tmp));
 	}
 	else
 	{
-		sprintf(tmp, " %ld/7 ", DOMAIN_GROUP_RID_USERS);
-		strcat(domain_groups, tmp);
+		slprintf(tmp, sizeof(tmp) -1, " %ld/7 ", DOMAIN_GROUP_RID_USERS);
+		pstrcat(domain_groups, tmp);
 
 		DEBUG(3,("domain user access %s granted\n", tmp));
 
 		if (user_in_list(user, lp_domain_admin_users()))
 		{
-			sprintf(tmp, " %ld/7 ", DOMAIN_GROUP_RID_ADMINS);
-			strcat(domain_groups, tmp);
+			slprintf(tmp, sizeof(tmp) - 1, " %ld/7 ", DOMAIN_GROUP_RID_ADMINS);
+			pstrcat(domain_groups, tmp);
 
 			DEBUG(3,("domain admin access %s granted\n", tmp));
 		}