Convert many uses of strcpy/strcat (and sometimes sprintf) to accepted

string-handling functions.

ticket: 6200
status: open

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21001 dc483132-0cff-0310-8789-dd5450dbe970

2 files changed, 19 insertions, 34 deletions

diff --git a/src/appl/bsd/krsh.c b/src/appl/bsd/krsh.c
index b12e25325..6441891ee 100644
--- a/src/appl/bsd/krsh.c
+++ b/src/appl/bsd/krsh.c
@@ -128,7 +128,7 @@ main(argc, argv0)
      char **argv0;
 {
     int rem, pid = 0;
-    char *host=0, *cp, **ap, buf[RCMD_BUFSIZ], *args, **argv = argv0, *user = 0;
+    char *host=0, **ap, buf[RCMD_BUFSIZ], *args, **argv = argv0, *user = 0;
     register int cc;
     struct passwd *pwd;
     fd_set readfrom, ready;
@@ -320,17 +320,13 @@ main(argc, argv0)
       cc += strlen(*ap) + 1;
     if (encrypt_flag)
       cc += 3;
-    cp = args = (char *) malloc((unsigned) cc);
-    if (encrypt_flag) {
-      strcpy(args, "-x ");
-      cp += 3;
-    }
+    args = (char *) malloc((unsigned) cc);
+    if (encrypt_flag)
+      strlcpy(args, "-x ", cc);
     for (ap = argv; *ap; ap++) {
-	(void) strcpy(cp, *ap);
-	while (*cp)
-	  cp++;
+      (void) strlcat(args, *ap, cc);
 	if (ap[1])
-	  *cp++ = ' ';
+	  strlcat(args, " ", cc);
     }
 
     if(debug_port == 0) {
diff --git a/src/appl/bsd/krshd.c b/src/appl/bsd/krshd.c
index 0c2c82eab..2b4c383bf 100644
--- a/src/appl/bsd/krshd.c
+++ b/src/appl/bsd/krshd.c
@@ -1522,19 +1522,18 @@ void doit(f, fromp)
 		offst = 3;
 	}
 
-        strcpy((char *) cmdbuf + offst, kprogdir);
+        strlcpy(cmdbuf + offst, kprogdir, sizeof(cmdbuf) - offst);
 	cp = copy + 3 + offst;
 
-	cmdbuf[sizeof(cmdbuf) - 1] = '\0';
-	if (auth_sys == KRB5_RECVAUTH_V4) {
-	  strncat(cmdbuf, "/v4rcp", sizeof(cmdbuf) - 1 - strlen(cmdbuf));
-	} else {
-	  strncat(cmdbuf, "/rcp", sizeof(cmdbuf) - 1 - strlen(cmdbuf));
-	}
+	if (auth_sys == KRB5_RECVAUTH_V4)
+	  strlcat(cmdbuf, "/v4rcp", sizeof(cmdbuf));
+	else
+	  strlcat(cmdbuf, "/rcp", sizeof(cmdbuf));
+
 	if (stat((char *)cmdbuf + offst, &s2) >= 0)
-	  strncat(cmdbuf, cp, sizeof(cmdbuf) - 1 - strlen(cmdbuf));
+	  strlcat(cmdbuf, cp, sizeof(cmdbuf));
 	else
-	  strncpy(cmdbuf, copy, sizeof(cmdbuf) - 1 - strlen(cmdbuf));
+	  strlcpy(cmdbuf, copy, sizeof(cmdbuf));
 	free(copy);
     }
 #endif
@@ -1948,27 +1947,17 @@ recvauth(netfd, peersin, valid_checksum)
 	struct sockaddr_storage adr;
 	unsigned int adr_length = sizeof(adr);
 	int e;
-	unsigned int buflen = strlen(cmdbuf)+strlen(locuser)+32;
-	char * chksumbuf = (char *) malloc(buflen);
+	char namebuf[32], *chksumbuf = NULL;
 
-	if (chksumbuf == 0)
-	    goto error_cleanup;
 	if (getsockname(netfd, (struct sockaddr *) &adr, &adr_length) != 0)
 	    goto error_cleanup;
 
 	e = getnameinfo((struct sockaddr *)&adr, adr_length, 0, 0,
-			chksumbuf, buflen, NI_NUMERICSERV);
-	if (e) {
-	    free(chksumbuf);
+			namebuf, sizeof(namebuf), NI_NUMERICSERV);
+	if (e)
 	    fatal(netfd, "local error: can't examine port number");
-	}
-	if (strlen(chksumbuf) > 30) {
-	    free(chksumbuf);
-	    fatal(netfd, "wacky local port number?!");
-	}
-	strcat(chksumbuf, ":");
-	strcat(chksumbuf,cmdbuf);
-	strcat(chksumbuf,locuser);
+	if (asprintf(&chksumbuf, "%s:%s%s", namebuf, cmdbuf, locuser) < 0)
+	    goto error_cleanup;
 
 	status = krb5_verify_checksum(bsd_context,
 				      authenticator->checksum->checksum_type,