From 7533cad751eaeabe5626cad636aefa8bf50d7409 Mon Sep 17 00:00:00 2001 From: Quentin Young Date: Sun, 7 Feb 2021 22:39:42 -0500 Subject: [PATCH] *: remove more sprintf() Should be just a couple non-development, non-test occurrences of this function left now. Signed-off-by: Quentin Young --- bgpd/bgp_mpath.c | 11 ++++-- bgpd/bgp_route.c | 37 ++++++++++-------- bgpd/bgp_route.h | 2 +- bgpd/bgp_routemap.c | 39 +++++++++++-------- doc/developer/workflow.rst | 2 +- isisd/isis_lsp.c | 12 +++--- isisd/isis_lsp.h | 4 +- isisd/isis_misc.c | 77 +++++++++++++++++++++++--------------- isisd/isis_vty_fabricd.c | 2 +- lib/prefix.c | 4 +- lib/prefix.h | 2 +- lib/vty.c | 6 +-- ospf6d/ospf6_abr.c | 6 ++- ospf6d/ospf6_asbr.c | 9 +++-- ospf6d/ospf6_intra.c | 8 ++-- zebra/irdp_interface.c | 18 +++++---- zebra/rt_netlink.c | 4 +- 17 files changed, 143 insertions(+), 100 deletions(-) diff --git a/bgpd/bgp_mpath.c b/bgpd/bgp_mpath.c index ff5cfe05fb..37639f4bce 100644 --- a/bgpd/bgp_mpath.c +++ b/bgpd/bgp_mpath.c @@ -616,7 +616,8 @@ void bgp_path_info_mpath_update(struct bgp_dest *dest, all_paths_lb = false; if (debug) { bgp_path_info_path_with_addpath_rx_str( - cur_mpath, path_buf); + cur_mpath, path_buf, + sizeof(path_buf)); zlog_debug( "%pRN: %s is still multipath, cur count %d", bgp_dest_to_rnode(dest), @@ -626,7 +627,8 @@ void bgp_path_info_mpath_update(struct bgp_dest *dest, mpath_changed = 1; if (debug) { bgp_path_info_path_with_addpath_rx_str( - cur_mpath, path_buf); + cur_mpath, path_buf, + sizeof(path_buf)); zlog_debug( "%pRN: remove mpath %s nexthop %s, cur count %d", bgp_dest_to_rnode(dest), @@ -660,7 +662,7 @@ void bgp_path_info_mpath_update(struct bgp_dest *dest, mpath_changed = 1; if (debug) { bgp_path_info_path_with_addpath_rx_str( - cur_mpath, path_buf); + cur_mpath, path_buf, sizeof(path_buf)); zlog_debug( "%pRN: remove mpath %s nexthop %s, cur count %d", bgp_dest_to_rnode(dest), path_buf, @@ -710,7 +712,8 @@ void bgp_path_info_mpath_update(struct bgp_dest *dest, all_paths_lb = false; if (debug) { bgp_path_info_path_with_addpath_rx_str( - new_mpath, path_buf); + new_mpath, path_buf, + sizeof(path_buf)); zlog_debug( "%pRN: add mpath %s nexthop %s, cur count %d", bgp_dest_to_rnode(dest), diff --git a/bgpd/bgp_route.c b/bgpd/bgp_route.c index 0ac9a42dc5..1953b769d2 100644 --- a/bgpd/bgp_route.c +++ b/bgpd/bgp_route.c @@ -519,13 +519,14 @@ static uint32_t bgp_med_value(struct attr *attr, struct bgp *bgp) } } -void bgp_path_info_path_with_addpath_rx_str(struct bgp_path_info *pi, char *buf) +void bgp_path_info_path_with_addpath_rx_str(struct bgp_path_info *pi, char *buf, + size_t buf_len) { if (pi->addpath_rx_id) - sprintf(buf, "path %s (addpath rxid %d)", pi->peer->host, - pi->addpath_rx_id); + snprintf(buf, buf_len, "path %s (addpath rxid %d)", + pi->peer->host, pi->addpath_rx_id); else - sprintf(buf, "path %s", pi->peer->host); + snprintf(buf, buf_len, "path %s", pi->peer->host); } /* Compare two bgp route entity. If 'new' is preferable over 'exist' return 1. @@ -576,7 +577,8 @@ static int bgp_path_info_cmp(struct bgp *bgp, struct bgp_path_info *new, } if (debug) - bgp_path_info_path_with_addpath_rx_str(new, new_buf); + bgp_path_info_path_with_addpath_rx_str(new, new_buf, + sizeof(new_buf)); if (exist == NULL) { *reason = bgp_path_selection_first; @@ -587,7 +589,8 @@ static int bgp_path_info_cmp(struct bgp *bgp, struct bgp_path_info *new, } if (debug) { - bgp_path_info_path_with_addpath_rx_str(exist, exist_buf); + bgp_path_info_path_with_addpath_rx_str(exist, exist_buf, + sizeof(exist_buf)); zlog_debug("%s: Comparing %s flags 0x%x with %s flags 0x%x", pfx_buf, new_buf, new->flags, exist_buf, exist->flags); @@ -615,10 +618,10 @@ static int bgp_path_info_cmp(struct bgp *bgp, struct bgp_path_info *new, prefix2str( bgp_dest_get_prefix(new->net), pfx_buf, sizeof(*pfx_buf) * PREFIX2STR_BUFFER); - bgp_path_info_path_with_addpath_rx_str(new, - new_buf); bgp_path_info_path_with_addpath_rx_str( - exist, exist_buf); + new, new_buf, sizeof(new_buf)); + bgp_path_info_path_with_addpath_rx_str( + exist, exist_buf, sizeof(exist_buf)); } if (newattr->sticky && !existattr->sticky) { @@ -2342,7 +2345,7 @@ void bgp_best_selection(struct bgp *bgp, struct bgp_dest *dest, if (debug) { bgp_path_info_path_with_addpath_rx_str( - new_select, path_buf); + new_select, path_buf, sizeof(path_buf)); zlog_debug( "%pBD: %s is the bestpath from AS %u", dest, path_buf, @@ -2416,8 +2419,8 @@ void bgp_best_selection(struct bgp *bgp, struct bgp_dest *dest, */ if (debug) { if (new_select) - bgp_path_info_path_with_addpath_rx_str(new_select, - path_buf); + bgp_path_info_path_with_addpath_rx_str( + new_select, path_buf, sizeof(path_buf)); else snprintf(path_buf, sizeof(path_buf), "NONE"); zlog_debug( @@ -2432,7 +2435,7 @@ void bgp_best_selection(struct bgp *bgp, struct bgp_dest *dest, if (debug) bgp_path_info_path_with_addpath_rx_str( - pi, path_buf); + pi, path_buf, sizeof(path_buf)); if (pi == new_select) { if (debug) @@ -6383,7 +6386,8 @@ DEFPY_YANG (bgp_network, bgp_network_cmd, int ret; ret = netmask_str2prefix_str(address_str, netmask_str, - addr_prefix_str); + addr_prefix_str, + sizeof(addr_prefix_str)); if (!ret) { vty_out(vty, "%% Inconsistent address and mask\n"); return CMD_WARNING_CONFIG_FAILED; @@ -7774,7 +7778,8 @@ DEFPY_YANG( char prefix_buf[PREFIX2STR_BUFFER]; if (addr_str) { - if (netmask_str2prefix_str(addr_str, mask_str, prefix_buf) + if (netmask_str2prefix_str(addr_str, mask_str, prefix_buf, + sizeof(prefix_buf)) == 0) { vty_out(vty, "%% Inconsistent address and mask\n"); return CMD_WARNING_CONFIG_FAILED; @@ -14291,7 +14296,7 @@ DEFUN (clear_ip_bgp_dampening_address_mask, char prefix_str[BUFSIZ]; ret = netmask_str2prefix_str(argv[idx_ipv4]->arg, argv[idx_ipv4_2]->arg, - prefix_str); + prefix_str, sizeof(prefix_str)); if (!ret) { vty_out(vty, "%% Inconsistent address and mask\n"); return CMD_WARNING; diff --git a/bgpd/bgp_route.h b/bgpd/bgp_route.h index 1060d2e60d..766e5ade92 100644 --- a/bgpd/bgp_route.h +++ b/bgpd/bgp_route.h @@ -598,7 +598,7 @@ extern void bgp_path_info_set_flag(struct bgp_dest *dest, extern void bgp_path_info_unset_flag(struct bgp_dest *dest, struct bgp_path_info *path, uint32_t flag); extern void bgp_path_info_path_with_addpath_rx_str(struct bgp_path_info *pi, - char *buf); + char *buf, size_t buf_len); extern int bgp_nlri_parse_ip(struct peer *, struct attr *, struct bgp_nlri *); diff --git a/bgpd/bgp_routemap.c b/bgpd/bgp_routemap.c index 3dc2cfbd5c..b7f3289ffc 100644 --- a/bgpd/bgp_routemap.c +++ b/bgpd/bgp_routemap.c @@ -4315,13 +4315,15 @@ DEFUN (match_community, int idx_comm_list = 2; int ret; char *argstr; + size_t argstr_len; if (argc == 4) { - argstr = XMALLOC(MTYPE_ROUTE_MAP_COMPILED, - strlen(argv[idx_comm_list]->arg) - + strlen("exact-match") + 2); + argstr_len = strlen(argv[idx_comm_list]->arg) + + strlen("exact-match") + 2; + argstr = XMALLOC(MTYPE_ROUTE_MAP_COMPILED, argstr_len); - sprintf(argstr, "%s exact-match", argv[idx_comm_list]->arg); + snprintf(argstr, argstr_len, "%s exact-match", + argv[idx_comm_list]->arg); } else argstr = argv[idx_comm_list]->arg; @@ -4362,13 +4364,15 @@ DEFUN (match_lcommunity, int idx_lcomm_list = 2; int ret; char *argstr; + size_t argstr_len; if (argc == 4) { - argstr = XMALLOC(MTYPE_ROUTE_MAP_COMPILED, - strlen(argv[idx_lcomm_list]->arg) - + strlen("exact-match") + 2); + argstr_len = strlen(argv[idx_lcomm_list]->arg) + + strlen("exact-match") + 2; + argstr = XMALLOC(MTYPE_ROUTE_MAP_COMPILED, argstr_len); - sprintf(argstr, "%s exact-match", argv[idx_lcomm_list]->arg); + snprintf(argstr, argstr_len, "%s exact-match", + argv[idx_lcomm_list]->arg); } else argstr = argv[idx_lcomm_list]->arg; @@ -5252,6 +5256,7 @@ DEFUN (set_aggregator_as, int ret; struct in_addr address; char *argstr; + size_t argstr_len; ret = inet_aton(argv[idx_ipv4]->arg, &address); if (ret == 0) { @@ -5259,11 +5264,12 @@ DEFUN (set_aggregator_as, return CMD_WARNING_CONFIG_FAILED; } - argstr = XMALLOC(MTYPE_ROUTE_MAP_COMPILED, - strlen(argv[idx_number]->arg) - + strlen(argv[idx_ipv4]->arg) + 2); + argstr_len = + strlen(argv[idx_number]->arg) + strlen(argv[idx_ipv4]->arg) + 2; + argstr = XMALLOC(MTYPE_ROUTE_MAP_COMPILED, argstr_len); - sprintf(argstr, "%s %s", argv[idx_number]->arg, argv[idx_ipv4]->arg); + snprintf(argstr, argstr_len, "%s %s", argv[idx_number]->arg, + argv[idx_ipv4]->arg); ret = generic_set_add(vty, VTY_GET_CONTEXT(route_map_index), "aggregator as", argstr); @@ -5289,6 +5295,7 @@ DEFUN (no_set_aggregator_as, int ret; struct in_addr address; char *argstr; + size_t argstr_len; if (argc <= idx_asn) return generic_set_delete(vty, VTY_GET_CONTEXT(route_map_index), @@ -5300,11 +5307,11 @@ DEFUN (no_set_aggregator_as, return CMD_WARNING_CONFIG_FAILED; } - argstr = XMALLOC(MTYPE_ROUTE_MAP_COMPILED, - strlen(argv[idx_asn]->arg) + strlen(argv[idx_ip]->arg) - + 2); + argstr_len = strlen(argv[idx_asn]->arg) + strlen(argv[idx_ip]->arg) + 2; + argstr = XMALLOC(MTYPE_ROUTE_MAP_COMPILED, argstr_len); - sprintf(argstr, "%s %s", argv[idx_asn]->arg, argv[idx_ip]->arg); + snprintf(argstr, argstr_len, "%s %s", argv[idx_asn]->arg, + argv[idx_ip]->arg); ret = generic_set_delete(vty, VTY_GET_CONTEXT(route_map_index), "aggregator as", argstr); diff --git a/doc/developer/workflow.rst b/doc/developer/workflow.rst index 861d87b998..71e2b00448 100644 --- a/doc/developer/workflow.rst +++ b/doc/developer/workflow.rst @@ -563,7 +563,7 @@ In general, code submitted into FRR will be rejected if it uses unsafe programming practices. While there is no enforced overall ruleset, the following requirements have achieved consensus: -- ``strcpy``, ``strcat`` and ``sprintf`` are inacceptable without exception. +- ``strcpy``, ``strcat`` and ``sprintf`` are unacceptable without exception. Use ``strlcpy``, ``strlcat`` and ``snprintf`` instead. (Rationale: even if you know the operation cannot overflow the buffer, a future code change may inadvertedly introduce an overflow.) diff --git a/isisd/isis_lsp.c b/isisd/isis_lsp.c index 6d2303817b..a17d9a6ae2 100644 --- a/isisd/isis_lsp.c +++ b/isisd/isis_lsp.c @@ -691,8 +691,8 @@ static void lsp_set_time(struct isis_lsp *lsp) stream_putw_at(lsp->pdu, 10, lsp->hdr.rem_lifetime); } -void lspid_print(uint8_t *lsp_id, char *dest, char dynhost, char frag, - struct isis *isis) +void lspid_print(uint8_t *lsp_id, char *dest, size_t dest_len, char dynhost, + char frag, struct isis *isis) { struct isis_dynhn *dyn = NULL; char id[SYSID_STRLEN]; @@ -710,10 +710,10 @@ void lspid_print(uint8_t *lsp_id, char *dest, char dynhost, char frag, memcpy(id, sysid_print(lsp_id), 15); if (frag) - sprintf(dest, "%s.%02x-%02x", id, LSP_PSEUDO_ID(lsp_id), - LSP_FRAGMENT(lsp_id)); + snprintf(dest, dest_len, "%s.%02x-%02x", id, + LSP_PSEUDO_ID(lsp_id), LSP_FRAGMENT(lsp_id)); else - sprintf(dest, "%s.%02x", id, LSP_PSEUDO_ID(lsp_id)); + snprintf(dest, dest_len, "%s.%02x", id, LSP_PSEUDO_ID(lsp_id)); } /* Convert the lsp attribute bits to attribute string */ @@ -747,7 +747,7 @@ void lsp_print(struct isis_lsp *lsp, struct vty *vty, char dynhost, char age_out[8]; char b[200]; - lspid_print(lsp->hdr.lsp_id, LSPid, dynhost, 1, isis); + lspid_print(lsp->hdr.lsp_id, LSPid, sizeof(LSPid), dynhost, 1, isis); vty_out(vty, "%-21s%c ", LSPid, lsp->own_lsp ? '*' : ' '); vty_out(vty, "%5hu ", lsp->hdr.pdu_len); vty_out(vty, "0x%08x ", lsp->hdr.seqno); diff --git a/isisd/isis_lsp.h b/isisd/isis_lsp.h index 0783036e49..896d957607 100644 --- a/isisd/isis_lsp.h +++ b/isisd/isis_lsp.h @@ -116,8 +116,8 @@ void lsp_update(struct isis_lsp *lsp, struct isis_lsp_hdr *hdr, struct isis_tlvs *tlvs, struct stream *stream, struct isis_area *area, int level, bool confusion); void lsp_inc_seqno(struct isis_lsp *lsp, uint32_t seqno); -void lspid_print(uint8_t *lsp_id, char *dest, char dynhost, char frag, - struct isis *isis); +void lspid_print(uint8_t *lsp_id, char *dest, size_t dest_len, char dynhost, + char frag, struct isis *isis); void lsp_print(struct isis_lsp *lsp, struct vty *vty, char dynhost, struct isis *isis); void lsp_print_detail(struct isis_lsp *lsp, struct vty *vty, char dynhost, diff --git a/isisd/isis_misc.c b/isisd/isis_misc.c index 6e9cbaf98e..d3d081d376 100644 --- a/isisd/isis_misc.c +++ b/isisd/isis_misc.c @@ -59,27 +59,30 @@ char nlpidstring[30]; const char *isonet_print(const uint8_t *from, int len) { int i = 0; - char *pos = isonet; + char tbuf[4]; + isonet[0] = '\0'; if (!from) return "unknown"; while (i < len) { if (i & 1) { - sprintf(pos, "%02x", *(from + i)); - pos += 2; + snprintf(tbuf, sizeof(tbuf), "%02x", *(from + i)); + strlcat(isonet, tbuf, sizeof(isonet)); } else { if (i == (len - 1)) { /* No dot at the end of address */ - sprintf(pos, "%02x", *(from + i)); - pos += 2; + snprintf(tbuf, sizeof(tbuf), "%02x", + *(from + i)); + strlcat(isonet, tbuf, sizeof(isonet)); } else { - sprintf(pos, "%02x.", *(from + i)); - pos += 3; + snprintf(tbuf, sizeof(tbuf), "%02x.", + *(from + i)); + strlcat(isonet, tbuf, sizeof(isonet)); } } i++; } - *(pos) = '\0'; + return isonet; } @@ -202,17 +205,18 @@ const char *nlpid2str(uint8_t nlpid) char *nlpid2string(struct nlpids *nlpids) { - char *pos = nlpidstring; int i; + char tbuf[256]; + nlpidstring[0] = '\0'; for (i = 0; i < nlpids->count; i++) { - pos += sprintf(pos, "%s", nlpid2str(nlpids->nlpids[i])); + snprintf(tbuf, sizeof(tbuf), "%s", + nlpid2str(nlpids->nlpids[i])); + strlcat(nlpidstring, tbuf, sizeof(nlpidstring)); if (nlpids->count - i > 1) - pos += sprintf(pos, ", "); + strlcat(nlpidstring, ", ", sizeof(nlpidstring)); } - *(pos) = '\0'; - return nlpidstring; } @@ -359,34 +363,47 @@ const char *isis_format_id(const uint8_t *id, size_t len) const char *time2string(uint32_t time) { - char *pos = datestring; uint32_t rest; + char tbuf[32]; + datestring[0] = '\0'; if (time == 0) return "-"; - if (time / SECS_PER_YEAR) - pos += sprintf(pos, "%uY", time / SECS_PER_YEAR); + if (time / SECS_PER_YEAR) { + snprintf(tbuf, sizeof(tbuf), "%uY", time / SECS_PER_YEAR); + strlcat(datestring, tbuf, sizeof(datestring)); + } rest = time % SECS_PER_YEAR; - if (rest / SECS_PER_MONTH) - pos += sprintf(pos, "%uM", rest / SECS_PER_MONTH); + if (rest / SECS_PER_MONTH) { + snprintf(tbuf, sizeof(tbuf), "%uM", rest / SECS_PER_MONTH); + strlcat(datestring, tbuf, sizeof(datestring)); + } rest = rest % SECS_PER_MONTH; - if (rest / SECS_PER_WEEK) - pos += sprintf(pos, "%uw", rest / SECS_PER_WEEK); + if (rest / SECS_PER_WEEK) { + snprintf(tbuf, sizeof(tbuf), "%uw", rest / SECS_PER_WEEK); + strlcat(datestring, tbuf, sizeof(datestring)); + } rest = rest % SECS_PER_WEEK; - if (rest / SECS_PER_DAY) - pos += sprintf(pos, "%ud", rest / SECS_PER_DAY); + if (rest / SECS_PER_DAY) { + snprintf(tbuf, sizeof(tbuf), "%ud", rest / SECS_PER_DAY); + strlcat(datestring, tbuf, sizeof(datestring)); + } rest = rest % SECS_PER_DAY; - if (rest / SECS_PER_HOUR) - pos += sprintf(pos, "%uh", rest / SECS_PER_HOUR); + if (rest / SECS_PER_HOUR) { + snprintf(tbuf, sizeof(tbuf), "%uh", rest / SECS_PER_HOUR); + strlcat(datestring, tbuf, sizeof(datestring)); + } rest = rest % SECS_PER_HOUR; - if (rest / SECS_PER_MINUTE) - pos += sprintf(pos, "%um", rest / SECS_PER_MINUTE); + if (rest / SECS_PER_MINUTE) { + snprintf(tbuf, sizeof(tbuf), "%um", rest / SECS_PER_MINUTE); + strlcat(datestring, tbuf, sizeof(datestring)); + } rest = rest % SECS_PER_MINUTE; - if (rest) - pos += sprintf(pos, "%us", rest); - - *(pos) = 0; + if (rest) { + snprintf(tbuf, sizeof(tbuf), "%us", rest); + strlcat(datestring, tbuf, sizeof(datestring)); + } return datestring; } diff --git a/isisd/isis_vty_fabricd.c b/isisd/isis_vty_fabricd.c index d0a411a8db..6055984195 100644 --- a/isisd/isis_vty_fabricd.c +++ b/isisd/isis_vty_fabricd.c @@ -118,7 +118,7 @@ static void lsp_print_flooding(struct vty *vty, struct isis_lsp *lsp, char lspid[255]; char buf[MONOTIME_STRLEN]; - lspid_print(lsp->hdr.lsp_id, lspid, true, true, isis); + lspid_print(lsp->hdr.lsp_id, lspid, sizeof(lspid), true, true, isis); vty_out(vty, "Flooding information for %s\n", lspid); if (!lsp->flooding_neighbors[TX_LSP_NORMAL]) { diff --git a/lib/prefix.c b/lib/prefix.c index 663a87afde..c98e0c1c72 100644 --- a/lib/prefix.c +++ b/lib/prefix.c @@ -1160,7 +1160,7 @@ in_addr_t ipv4_broadcast_addr(in_addr_t hostaddr, int masklen) ex.) "1.1.0.0" "255.255.0.0" => "1.1.0.0/16" ex.) "1.0.0.0" NULL => "1.0.0.0/8" */ int netmask_str2prefix_str(const char *net_str, const char *mask_str, - char *prefix_str) + char *prefix_str, size_t prefix_str_len) { struct in_addr network; struct in_addr mask; @@ -1193,7 +1193,7 @@ int netmask_str2prefix_str(const char *net_str, const char *mask_str, return 0; } - sprintf(prefix_str, "%s/%d", net_str, prefixlen); + snprintf(prefix_str, prefix_str_len, "%s/%d", net_str, prefixlen); return 1; } diff --git a/lib/prefix.h b/lib/prefix.h index b7fdc26369..b2f3b0592f 100644 --- a/lib/prefix.h +++ b/lib/prefix.h @@ -491,7 +491,7 @@ extern void masklen2ip(const int, struct in_addr *); * special treatment for /31 according to RFC3021 section 3.3 */ extern in_addr_t ipv4_broadcast_addr(in_addr_t hostaddr, int masklen); -extern int netmask_str2prefix_str(const char *, const char *, char *); +extern int netmask_str2prefix_str(const char *, const char *, char *, size_t); extern struct prefix_ipv6 *prefix_ipv6_new(void); extern void prefix_ipv6_free(struct prefix_ipv6 **p); diff --git a/lib/vty.c b/lib/vty.c index 4062b183e7..66b607861c 100644 --- a/lib/vty.c +++ b/lib/vty.c @@ -2414,9 +2414,9 @@ bool vty_read_config(struct nb_config *config, const char *config_file, __func__, errno); goto tmp_free_and_out; } - tmp = XMALLOC(MTYPE_TMP, - strlen(cwd) + strlen(config_file) + 2); - sprintf(tmp, "%s/%s", cwd, config_file); + size_t tmp_len = strlen(cwd) + strlen(config_file) + 2; + tmp = XMALLOC(MTYPE_TMP, tmp_len); + snprintf(tmp, tmp_len, "%s/%s", cwd, config_file); fullpath = tmp; } else fullpath = config_file; diff --git a/ospf6d/ospf6_abr.c b/ospf6d/ospf6_abr.c index 7bd51138b3..465f0291f4 100644 --- a/ospf6d/ospf6_abr.c +++ b/ospf6d/ospf6_abr.c @@ -1265,6 +1265,7 @@ static char *ospf6_inter_area_prefix_lsa_get_prefix_str(struct ospf6_lsa *lsa, { struct ospf6_inter_prefix_lsa *prefix_lsa; struct in6_addr in6; + char tbuf[16]; if (lsa != NULL) { prefix_lsa = @@ -1274,8 +1275,9 @@ static char *ospf6_inter_area_prefix_lsa_get_prefix_str(struct ospf6_lsa *lsa, ospf6_prefix_in6_addr(&in6, prefix_lsa, &prefix_lsa->prefix); if (buf) { inet_ntop(AF_INET6, &in6, buf, buflen); - sprintf(&buf[strlen(buf)], "/%d", - prefix_lsa->prefix.prefix_length); + snprintf(tbuf, sizeof(tbuf), "/%d", + prefix_lsa->prefix.prefix_length); + strlcat(buf, tbuf, buflen); } } diff --git a/ospf6d/ospf6_asbr.c b/ospf6d/ospf6_asbr.c index 3449f48267..d0c93dd577 100644 --- a/ospf6d/ospf6_asbr.c +++ b/ospf6d/ospf6_asbr.c @@ -1865,6 +1865,7 @@ static char *ospf6_as_external_lsa_get_prefix_str(struct ospf6_lsa *lsa, struct ospf6_as_external_lsa *external; struct in6_addr in6; int prefix_length = 0; + char tbuf[16]; if (lsa) { external = (struct ospf6_as_external_lsa *)OSPF6_LSA_HEADER_END( @@ -1885,9 +1886,11 @@ static char *ospf6_as_external_lsa_get_prefix_str(struct ospf6_lsa *lsa, } if (buf) { inet_ntop(AF_INET6, &in6, buf, buflen); - if (prefix_length) - sprintf(&buf[strlen(buf)], "/%d", - prefix_length); + if (prefix_length) { + snprintf(tbuf, sizeof(tbuf), "/%d", + prefix_length); + strlcat(buf, tbuf, buflen); + } } } return (buf); diff --git a/ospf6d/ospf6_intra.c b/ospf6d/ospf6_intra.c index fd154e7ee5..1a81d50b68 100644 --- a/ospf6d/ospf6_intra.c +++ b/ospf6d/ospf6_intra.c @@ -83,7 +83,7 @@ static char *ospf6_router_lsa_get_nbr_id(struct ospf6_lsa *lsa, char *buf, sizeof(buf1)); inet_ntop(AF_INET, &lsdesc->neighbor_router_id, buf2, sizeof(buf2)); - sprintf(buf, "%s/%s", buf2, buf1); + snprintf(buf, buflen, "%s/%s", buf2, buf1); return buf; } @@ -865,6 +865,7 @@ static char *ospf6_intra_prefix_lsa_get_prefix_str(struct ospf6_lsa *lsa, struct in6_addr in6; int prefixnum, cnt = 0; struct ospf6_prefix *prefix; + char tbuf[16]; if (lsa) { intra_prefix_lsa = @@ -897,8 +898,9 @@ static char *ospf6_intra_prefix_lsa_get_prefix_str(struct ospf6_lsa *lsa, OSPF6_PREFIX_SPACE( prefix->prefix_length)); inet_ntop(AF_INET6, &in6, buf, buflen); - sprintf(&buf[strlen(buf)], "/%d", - prefix->prefix_length); + snprintf(tbuf, sizeof(tbuf), "/%d", + prefix->prefix_length); + strlcat(buf, tbuf, buflen); return (buf); } } while (current <= end); diff --git a/zebra/irdp_interface.c b/zebra/irdp_interface.c index 2ab5fd3a4c..5352c6214d 100644 --- a/zebra/irdp_interface.c +++ b/zebra/irdp_interface.c @@ -93,10 +93,10 @@ static int irdp_if_delete(struct interface *ifp) return 0; } -static const char *inet_2a(uint32_t a, char *b) +static const char *inet_2a(uint32_t a, char *b, size_t b_len) { - sprintf(b, "%u.%u.%u.%u", (a)&0xFF, (a >> 8) & 0xFF, (a >> 16) & 0xFF, - (a >> 24) & 0xFF); + snprintf(b, b_len, "%u.%u.%u.%u", (a)&0xFF, (a >> 8) & 0xFF, + (a >> 16) & 0xFF, (a >> 24) & 0xFF); return b; } @@ -140,7 +140,8 @@ static int if_group(struct interface *ifp, int sock, uint32_t group, flog_err_sys(EC_LIB_SOCKET, "IRDP: %s can't setsockopt %s: %s", add_leave == IP_ADD_MEMBERSHIP ? "join group" : "leave group", - inet_2a(group, b1), safe_strerror(errno)); + inet_2a(group, b1, sizeof(b1)), + safe_strerror(errno)); return ret; } @@ -162,7 +163,8 @@ static int if_add_group(struct interface *ifp) if (irdp->flags & IF_DEBUG_MISC) zlog_debug("IRDP: Adding group %s for %s", - inet_2a(htonl(INADDR_ALLRTRS_GROUP), b1), ifp->name); + inet_2a(htonl(INADDR_ALLRTRS_GROUP), b1, sizeof(b1)), + ifp->name); return 0; } @@ -183,7 +185,8 @@ static int if_drop_group(struct interface *ifp) if (irdp->flags & IF_DEBUG_MISC) zlog_debug("IRDP: Leaving group %s for %s", - inet_2a(htonl(INADDR_ALLRTRS_GROUP), b1), ifp->name); + inet_2a(htonl(INADDR_ALLRTRS_GROUP), b1, sizeof(b1)), + ifp->name); return 0; } @@ -383,7 +386,8 @@ int irdp_config_write(struct vty *vty, struct interface *ifp) for (ALL_LIST_ELEMENTS_RO(irdp->AdvPrefList, node, adv)) vty_out(vty, " ip irdp address %s preference %d\n", - inet_2a(adv->ip.s_addr, b1), adv->pref); + inet_2a(adv->ip.s_addr, b1, sizeof(b1)), + adv->pref); vty_out(vty, " ip irdp holdtime %d\n", irdp->Lifetime); diff --git a/zebra/rt_netlink.c b/zebra/rt_netlink.c index 3af3586d31..04b6b379a9 100644 --- a/zebra/rt_netlink.c +++ b/zebra/rt_netlink.c @@ -1132,8 +1132,8 @@ static int build_label_stack(struct mpls_label_stack *nh_label, if (IS_ZEBRA_DEBUG_KERNEL) { if (!num_labels) - sprintf(label_buf, "label %u", - nh_label->label[i]); + snprintf(label_buf, label_buf_size, "label %u", + nh_label->label[i]); else { snprintf(label_buf1, sizeof(label_buf1), "/%u", nh_label->label[i]); -- 2.39.5