venus: convert fs.c to safer string functions

Convert string handling to safer functions to avoid buffer overflows.

Reviewed-on: https://gerrit.openafs.org/12923
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
Tested-by: BuildBot <buildbot@rampaginggeek.com>
(cherry picked from commit 5a8b68153124c3a9224f0b6993df9de9c6c54541)

Change-Id: Ic7fd4c3c0ffd4b0b38b9735002e9bf8eba8fd0d6
Reviewed-on: https://gerrit.openafs.org/13100
Reviewed-by: Michael Meffie <mmeffie@sinenomine.net>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
Tested-by: BuildBot <buildbot@rampaginggeek.com>

diff --git a/src/venus/fs.c b/src/venus/fs.c
index ef9d4db..39f266a 100644 (file)
--- a/src/venus/fs.c
+++ b/src/venus/fs.c
@@ -767,17 +767,17 @@ AclToString(struct Acl *acl)
     struct AclEntry *tp;
 
     if (acl->dfs)
-       sprintf(dfsstring, " dfs:%d %s", acl->dfs, acl->cell);
+       snprintf(dfsstring, sizeof(dfsstring), " dfs:%d %s", acl->dfs, acl->cell);
     else
        dfsstring[0] = '\0';
-    sprintf(mydata, "%d%s\n%d\n", acl->nplus, dfsstring, acl->nminus);
+    snprintf(mydata, sizeof(mydata), "%d%s\n%d\n", acl->nplus, dfsstring, acl->nminus);
     for (tp = acl->pluslist; tp; tp = tp->next) {
-       sprintf(tstring, "%s %d\n", tp->name, tp->rights);
-       strcat(mydata, tstring);
+       snprintf(tstring, sizeof(tstring), "%s %d\n", tp->name, tp->rights);
+       strlcat(mydata, tstring, sizeof(mydata));
     }
     for (tp = acl->minuslist; tp; tp = tp->next) {
-       sprintf(tstring, "%s %d\n", tp->name, tp->rights);
-       strcat(mydata, tstring);
+       snprintf(tstring, sizeof(tstring), "%s %d\n", tp->name, tp->rights);
+       strlcat(mydata, tstring, sizeof(mydata));
     }
     return mydata;
 }
@@ -2402,7 +2402,7 @@ ListCellsCmd(struct cmd_syndesc *as, void *arock)
                name = hostutil_GetNameByINet(addr);
            } else {
                addr = ntohl(addr);
-               sprintf(tbuffer, "%d.%d.%d.%d", (addr >> 24) & 0xff,
+               snprintf(tbuffer, sizeof(tbuffer), "%d.%d.%d.%d", (addr >> 24) & 0xff,
                        (addr >> 16) & 0xff, (addr >> 8) & 0xff, addr & 0xff);
                name = tbuffer;
            }
@@ -3343,7 +3343,7 @@ GetPrefCmd(struct cmd_syndesc *as, void *arock)
                name = hostutil_GetNameByINet(out->servers[i].server.s_addr);
            } else {
                addr = ntohl(out->servers[i].server.s_addr);
-               sprintf(tbuffer, "%d.%d.%d.%d", (addr >> 24) & 0xff,
+               snprintf(tbuffer, sizeof(tbuffer), "%d.%d.%d.%d", (addr >> 24) & 0xff,
                        (addr >> 16) & 0xff, (addr >> 8) & 0xff, addr & 0xff);
                name = tbuffer;
            }
@@ -4054,9 +4054,9 @@ GetClientAddrsCmd(struct cmd_syndesc *as, void *arock)
            out = (struct sprefinfo *)blob.out;
            for (i = 0; i < out->num_servers; i++) {
                afs_int32 addr;
-               char tbuffer[32];
+               char tbuffer[20];
                addr = ntohl(out->servers[i].server.s_addr);
-               sprintf(tbuffer, "%d.%d.%d.%d", (addr >> 24) & 0xff,
+               snprintf(tbuffer, sizeof(tbuffer), "%d.%d.%d.%d", (addr >> 24) & 0xff,
                        (addr >> 16) & 0xff, (addr >> 8) & 0xff, addr & 0xff);
                printf("%-50s\n", tbuffer);
            }