Use snprintf instead of strcpy/strcat in many places

ticket: 6200
status: open

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@20912 dc483132-0cff-0310-8789-dd5450dbe970

7 files changed, 20 insertions, 57 deletions

diff --git a/src/lib/des425/read_passwd.c b/src/lib/des425/read_passwd.c
index e1b4c713c..bdcb32999 100644
--- a/src/lib/des425/read_passwd.c
+++ b/src/lib/des425/read_passwd.c
@@ -114,9 +114,8 @@ des_read_pw_string(s, max, prompt, verify)
     char prompt2[BUFSIZ];
 
     if (verify) {
-	strcpy(prompt2, "Verifying, please re-enter ");
-	strncat(prompt2, prompt, sizeof(prompt2)-(strlen(prompt2)+1));
-	prompt2[sizeof(prompt2)-1] = '\0';
+	snprintf(prompt2, sizeof(prompt2), "Verifying, please re-enter %s",
+		 prompt);
     }
     ok = des_rd_pwstr_2prompt(s, max, prompt, verify ? prompt2 : 0);
     return ok;
diff --git a/src/lib/kdb/kdb_default.c b/src/lib/kdb/kdb_default.c
index d6f724ce0..f7a855b72 100644
--- a/src/lib/kdb/kdb_default.c
+++ b/src/lib/kdb/kdb_default.c
@@ -152,11 +152,8 @@ krb5_def_store_mkey(krb5_context   context,
     int statrc;
 
     if (!keyfile) {
-        (void) strcpy(defkeyfile, DEFAULT_KEYFILE_STUB);
-        (void) strncat(defkeyfile, realm->data,
-            min(sizeof(defkeyfile)-sizeof(DEFAULT_KEYFILE_STUB)-1,
-                realm->length));
-        defkeyfile[sizeof(defkeyfile) - 1] = '\0';
+        (void) snprintf(defkeyfile, sizeof(defkeyfile), "%s%s",
+                        DEFAULT_KEYFILE_STUB, realm->data);
         keyfile = defkeyfile;
     }
 
@@ -392,10 +389,8 @@ krb5_db_def_fetch_mkey(krb5_context   context,
     if (db_args != NULL) {
         (void) strncpy(keyfile, db_args, sizeof(keyfile));
     } else {
-        (void) strcpy(keyfile, DEFAULT_KEYFILE_STUB);
-        (void) strncat(keyfile, realm->data,
-            min(sizeof(keyfile)-sizeof(DEFAULT_KEYFILE_STUB)-1,
-                realm->length));
+        (void) snprintf(keyfile, sizeof(keyfile), "%s%s",
+                        DEFAULT_KEYFILE_STUB, realm->data);
     }
     /* null terminate no matter what */
     keyfile[sizeof(keyfile) - 1] = '\0';
diff --git a/src/lib/krb5/ccache/cc_file.c b/src/lib/krb5/ccache/cc_file.c
index 22c01b8b7..b5a099059 100644
--- a/src/lib/krb5/ccache/cc_file.c
+++ b/src/lib/krb5/ccache/cc_file.c
@@ -1997,8 +1997,7 @@ krb5_fcc_generate_new (krb5_context context, krb5_ccache *id)
      if (kret)
 	 return kret;
 
-     (void) strcpy(scratch, TKT_ROOT);
-     (void) strcat(scratch, "XXXXXX");
+     (void) snprintf(scratch, sizeof(scratch), "%sXXXXXX", TKT_ROOT);
      ret = mkstemp(scratch);
      if (ret == -1) {
          k5_cc_mutex_unlock(context, &krb5int_cc_file_mutex);
diff --git a/src/lib/krb5/keytab/kt_file.c b/src/lib/krb5/keytab/kt_file.c
index bf394d887..83fb26485 100644
--- a/src/lib/krb5/keytab/kt_file.c
+++ b/src/lib/krb5/keytab/kt_file.c
@@ -440,21 +440,12 @@ krb5_ktfile_get_name(krb5_context context, krb5_keytab id, char *name, unsigned
    * trt will happen if the name is passed back to resolve.
    */
 {
-    memset(name, 0, len);
-
-    if (len < strlen(id->ops->prefix)+2)
-	return(KRB5_KT_NAME_TOOLONG);
-    strcpy(name, id->ops->prefix);
-    name += strlen(id->ops->prefix);
-    name[0] = ':';
-    name++;
-    len -= strlen(id->ops->prefix)+1;
+    int result;
 
-    if (len < strlen(KTFILENAME(id))+1)
+    memset(name, 0, len);
+    result = snprintf(name, len, "%s:%s", id->ops->prefix, KTFILENAME(id));
+    if (SNPRINTF_OVERFLOW(result, len))
 	return(KRB5_KT_NAME_TOOLONG);
-    strcpy(name, KTFILENAME(id));
-    /* strcpy will NUL-terminate the destination */
-
     return(0);
 }
 
diff --git a/src/lib/krb5/keytab/kt_memory.c b/src/lib/krb5/keytab/kt_memory.c
index 1b4af9bd6..53d15edd8 100644
--- a/src/lib/krb5/keytab/kt_memory.c
+++ b/src/lib/krb5/keytab/kt_memory.c
@@ -472,21 +472,12 @@ krb5_mkt_get_entry(krb5_context context, krb5_keytab id,
 krb5_error_code KRB5_CALLCONV
 krb5_mkt_get_name(krb5_context context, krb5_keytab id, char *name, unsigned int len)
 {
-    memset(name, 0, len);
-
-    if (len < strlen(id->ops->prefix)+2)
-	return(KRB5_KT_NAME_TOOLONG);
-    strcpy(name, id->ops->prefix);
-    name += strlen(id->ops->prefix);
-    name[0] = ':';
-    name++;
-    len -= strlen(id->ops->prefix)+1;
+    int result;
 
-    if (len < strlen(KTNAME(id))+1)
+    memset(name, 0, len);
+    result = snprintf(name, len, "%s:%s", id->ops->prefix, KTNAME(id));
+    if (SNPRINTF_OVERFLOW(result, len))
 	return(KRB5_KT_NAME_TOOLONG);
-    strcpy(name, KTNAME(id));
-    /* strcpy will NUL-terminate the destination */
-
     return(0);
 }
 
diff --git a/src/lib/krb5/keytab/kt_srvtab.c b/src/lib/krb5/keytab/kt_srvtab.c
index da09d87a5..4555ca332 100644
--- a/src/lib/krb5/keytab/kt_srvtab.c
+++ b/src/lib/krb5/keytab/kt_srvtab.c
@@ -248,21 +248,12 @@ krb5_ktsrvtab_get_name(krb5_context context, krb5_keytab id, char *name, unsigne
    * trt will happen if the name is passed back to resolve.
    */
 {
-    memset(name, 0, len);
-
-    if (len < strlen(id->ops->prefix)+2)
-	return(KRB5_KT_NAME_TOOLONG);
-    strcpy(name, id->ops->prefix);
-    name += strlen(id->ops->prefix);
-    name[0] = ':';
-    name++;
-    len -= strlen(id->ops->prefix)+1;
+    int result;
 
-    if (len < strlen(KTFILENAME(id))+1)
+    memset(name, 0, len);
+    result = snprintf(name, len, "%s:%s", id->ops->prefix, KTFILENAME(id));
+    if (SNPRINTF_OVERFLOW(result, len))
 	return(KRB5_KT_NAME_TOOLONG);
-    strcpy(name, KTFILENAME(id));
-    /* strcpy will NUL-terminate the destination */
-
     return(0);
 }
 
diff --git a/src/lib/krb5/krb/gic_pwd.c b/src/lib/krb5/krb/gic_pwd.c
index bd5cbd195..ab491105e 100644
--- a/src/lib/krb5/krb/gic_pwd.c
+++ b/src/lib/krb5/krb/gic_pwd.c
@@ -45,10 +45,7 @@ krb5_get_as_key_password(
 	if ((ret = krb5_unparse_name(context, client, &clientstr)))
 	  return(ret);
 
-	strcpy(promptstr, "Password for ");
-	strncat(promptstr, clientstr, sizeof(promptstr)-strlen(promptstr)-1);
-	promptstr[sizeof(promptstr)-1] = '\0';
-
+	snprintf(promptstr, sizeof(promptstr), "Password for %s", clientstr);
 	free(clientstr);
 
 	prompt.prompt = promptstr;