--- nmh-0.27/h/prototypes.h.security Mon Jun 29 00:07:25 1998 +++ nmh-0.27/h/prototypes.h Sat Jul 18 14:04:47 1998 @@ -44,6 +44,7 @@ void context_save (void); char *copy (char *, char *); char **copyip (char **, char **); +char **copyip_n (char **, char **, int); void cpydata (int, int, char *, char *); void cpydgst (int, int, char *, char *); int decode_rfc2047 (char *, char *); --- nmh-0.27/sbr/copyip.c.security Sun Jan 4 12:07:01 1998 +++ nmh-0.27/sbr/copyip.c Sat Jul 18 14:04:47 1998 @@ -17,3 +17,11 @@ return q; } + +char **copyip_n(char **p, char **q, int n) +{ + while(*p && --n) + *q++=*p++; + *q=NULL; + return q; +} --- nmh-0.27/sbr/fmt_scan.c.security Thu May 21 03:31:13 1998 +++ nmh-0.27/sbr/fmt_scan.c Sat Jul 18 14:04:47 1998 @@ -237,9 +237,9 @@ return NULL; if (get_x400_comp (mbox, "/G=", given)) - sprintf (buffer, "%s %s", given, surname); + snprintf (buffer, BUFSIZ, "%s %s", given, surname); else - strcpy (buffer, surname); + snprintf (buffer, BUFSIZ, "%s", surname); return buffer; } @@ -254,7 +254,7 @@ || !(cp = strchr(mbox += idx + strlen (key), '/'))) return 0; - sprintf (buffer, "%*.*s", cp - mbox, cp - mbox, mbox); + snprintf (buffer, BUFSIZ, "%*.*s", cp - mbox, cp - mbox, mbox); return 1; } @@ -446,7 +446,7 @@ if (str) { char *xp; - strcpy(buffer, str); + strncpy(buffer, str, BUFSIZ); str = buffer; while (isspace(*str)) str++; @@ -631,7 +631,7 @@ goto unfriendly; if ((str = mn->m_pers) == NULL) if ((str = mn->m_note)) { - strcpy (buffer, str); + strncpy (buffer, str, BUFSIZ); str = buffer; if (*str == '(') str++; @@ -651,12 +651,12 @@ str = mn->m_mbox; break; case UUCPHOST: - sprintf (buffer, "%s!%s", mn->m_host, mn->m_mbox); + snprintf (buffer, BUFSIZ, "%s!%s", mn->m_host, mn->m_mbox); str = buffer; break; default: if (mn->m_mbox) { - sprintf (buffer, "%s@%s", mn->m_mbox, mn->m_host); + snprintf (buffer, BUFSIZ, "%s@%s", mn->m_mbox, mn->m_host); str= buffer; } else --- nmh-0.27/sbr/folder_delmsgs.c.security Sun Jan 4 12:46:47 1998 +++ nmh-0.27/sbr/folder_delmsgs.c Sat Jul 18 14:04:47 1998 @@ -71,7 +71,7 @@ dp = m_name (msgnum); if (rename_msgs) { /* rename messages with standard prefix */ - strcpy (buf, m_backup (dp)); + strncpy (buf, m_backup (dp), sizeof(buf)); if (rename (dp, buf) == -1) { admonish (buf, "unable to rename %s to", dp); retval = -1; --- nmh-0.27/sbr/folder_pack.c.security Mon May 11 21:03:32 1998 +++ nmh-0.27/sbr/folder_pack.c Sat Jul 18 14:04:47 1998 @@ -44,8 +44,8 @@ for (msgnum = mp->lowmsg, hole = 1; msgnum <= mp->hghmsg; msgnum++) { if (does_exist (mp, msgnum)) { if (msgnum != hole) { - strcpy (newmsg, m_name (hole)); - strcpy (oldmsg, m_name (msgnum)); + strncpy (newmsg, m_name (hole), BUFSIZ); + strncpy (oldmsg, m_name (msgnum), BUFSIZ); if (verbose) printf ("message %s becomes %s\n", oldmsg, newmsg); --- nmh-0.27/sbr/lock_file.c.security Sun Jan 4 13:19:26 1998 +++ nmh-0.27/sbr/lock_file.c Sat Jul 18 14:04:47 1998 @@ -380,7 +380,7 @@ lockname (char *file, struct lockinfo *li, int isnewlock) { char *bp, *cp; - + int blen=BUFSIZ; #if 0 struct stat st; #endif @@ -390,11 +390,11 @@ cp = file; #ifdef LOCKDIR - sprintf (bp, "%s/", lockdir); + blen -= snprintf (bp, BUFSIZ, "%s/", lockdir); bp += strlen (bp); #else if (cp != file) { - sprintf (bp, "%.*s", cp - file, file); + blen -= snprintf (bp, BUFSIZ, "%.*s", cp - file, file); bp += strlen (bp); } #endif @@ -411,7 +411,7 @@ sprintf (bp, "LCK%05d.%05d", st.st_dev, st.st_ino); #endif - sprintf (bp, "%s.lock", cp); + snprintf (bp, blen, "%s.lock", cp); /* * If this is for a new lock, create a name for @@ -421,7 +421,7 @@ if ((cp = strrchr(li->curlock, '/')) == NULL || *++cp == 0) strcpy (li->tmplock, ",LCK.XXXXXX"); else - sprintf (li->tmplock, "%.*s,LCK.XXXXXX", + snprintf (li->tmplock, BUFSIZ, "%.*s,LCK.XXXXXX", cp - li->curlock, li->curlock); unlink (mktemp (li->tmplock)); } --- nmh-0.27/sbr/m_convert.c.security Sat Jan 10 02:35:45 1998 +++ nmh-0.27/sbr/m_convert.c Sat Jul 18 14:04:47 1998 @@ -263,7 +263,11 @@ #else while ((*cp >= 'a' && *cp <= 'z') || *cp == '.') #endif /* LOCALE */ + { + if(bp-buf>=sizeof(buf)) + break; *bp++ = *cp++; + } *bp++ = '\0'; delimp = cp; --- nmh-0.27/sbr/m_draft.c.security Sun Feb 8 17:33:01 1998 +++ nmh-0.27/sbr/m_draft.c Sat Jul 18 14:04:47 1998 @@ -31,7 +31,7 @@ *isdf = 1; chdir (m_maildir ("")); - strcpy (buffer, m_maildir (folder)); + strncpy (buffer, m_maildir (folder), BUFSIZ); if (stat (buffer, &st) == -1) { if (errno != ENOENT) adios (buffer, "error on folder"); --- nmh-0.27/sbr/m_getfld.c.security Mon May 25 15:54:17 1998 +++ nmh-0.27/sbr/m_getfld.c Sat Jul 18 14:04:47 1998 @@ -538,7 +538,7 @@ ; #else /* RPATHS */ cp = unixbuf; - while ((c = getc (iob)) != '\n') + while ((c = getc (iob)) != '\n' && cp-unixbuf < BUFSIZ-1) *cp++ = c; *cp = 0; #endif /* RPATHS */ @@ -639,7 +639,7 @@ break; #else /* RPATHS */ cp = unixbuf; - while ((c = getc (iob)) != '\n' && c >= 0) + while ((c = getc (iob)) != '\n' && c >= 0 && cp-unixbuf < BUFSIZ-1) *cp++ = c; *cp = 0; #endif /* RPATHS */ @@ -688,10 +688,10 @@ if (cp) { /* return path for UUCP style addressing */ dp = strchr (++cp, '\n'); - sprintf (rp, "%.*s!%.*s\n", dp - cp, cp, bp - ap, ap); + snprintf (rp, BUFSIZ, "%.*s!%.*s\n", dp - cp, cp, bp - ap, ap); } else { /* return path for standard domain addressing */ - sprintf (rp, "%.*s\n", bp - ap, ap); + snprintf (rp, BUFSIZ, "%.*s\n", bp - ap, ap); } /* @@ -702,7 +702,7 @@ bp++; /* Now get delivery date from envelope */ - sprintf (dd, "%.*s\n", 24, bp); + snprintf (dd, BUFSIZ, "%.*s\n", 24, bp); unixbuf[0] = 0; return 1; --- nmh-0.27/sbr/m_maildir.c.security Sun Dec 14 04:25:16 1997 +++ nmh-0.27/sbr/m_maildir.c Sat Jul 18 14:04:47 1998 @@ -47,9 +47,9 @@ && strcmp (folder, DOT) && strcmp (folder, DOTDOT) && strncmp (folder, PWD, NPWD)) { - strcpy (maildir, mailfold); /* preserve... */ + strncpy (maildir, mailfold, BUFSIZ); /* preserve... */ cp = getcpy (m_maildir (folder)); - strcpy (mailfold, maildir); + strncpy (mailfold, maildir, BUFSIZ); } else { cp = path (folder, TFOLDER); } @@ -72,14 +72,15 @@ && strcmp (folder, DOT) && strcmp (folder, DOTDOT) && strncmp (folder, PWD, NPWD))) { - strcpy (mailfold, folder); + strncpy (mailfold, folder, sizeof(mailfold)); + mailfold[sizeof(mailfold)-1]=0; return mailfold; } cp = mailfold; if ((pp = context_find ("path")) && *pp) { if (*pp != '/') { - sprintf (cp, "%s/", mypath); + snprintf (cp, BUFSIZ, "%s/", mypath); cp += strlen (cp); } cp = copy (pp, cp); @@ -88,7 +89,7 @@ cp = copy (path ("./", TFOLDER), cp); if (cp[-1] != '/') *cp++ = '/'; - strcpy (cp, folder); + strncpy (cp, folder, BUFSIZ-(cp-mailfold)); return mailfold; } --- nmh-0.27/sbr/m_name.c.security Tue May 20 01:19:12 1997 +++ nmh-0.27/sbr/m_name.c Sat Jul 18 14:04:47 1998 @@ -16,6 +16,6 @@ if (num <= 0) return "?"; - sprintf (name, "%d", num); + snprintf (name, BUFSIZ, "%d", num); return name; } --- nmh-0.27/sbr/m_scratch.c.security Sun Jan 4 17:15:18 1998 +++ nmh-0.27/sbr/m_scratch.c Sat Jul 18 14:04:47 1998 @@ -14,12 +14,12 @@ char *cp; static char buffer[BUFSIZ], tmpfil[BUFSIZ]; - sprintf (tmpfil, "%sXXXXXX", template); + snprintf (tmpfil, BUFSIZ, "%sXXXXXX", template); mktemp (tmpfil); if ((cp = r1bindex (file, '/')) == file) - strcpy (buffer, tmpfil); + strncpy (buffer, tmpfil, BUFSIZ); else - sprintf (buffer, "%.*s%s", cp - file, file, tmpfil); + snprintf (buffer, BUFSIZ, "%.*s%s", cp - file, file, tmpfil); unlink (buffer); return buffer; --- nmh-0.27/sbr/m_tmpfil.c.security Tue May 20 01:19:12 1997 +++ nmh-0.27/sbr/m_tmpfil.c Sat Jul 18 14:04:47 1998 @@ -13,7 +13,7 @@ { static char tmpfil[BUFSIZ]; - sprintf(tmpfil, "/tmp/%sXXXXXX", template); + snprintf(tmpfil, BUFSIZ, "/tmp/%sXXXXXX", template); unlink(mktemp(tmpfil)); return tmpfil; --- nmh-0.27/sbr/makedir.c.security Sun Jan 4 12:47:57 1998 +++ nmh-0.27/sbr/makedir.c Sat Jul 18 14:04:47 1998 @@ -28,7 +28,7 @@ fflush(stdout); if (getuid () == geteuid ()) { - c = strcpy(path, dir); + c = strncpy(path, dir, PATH_MAX); while ((c = strchr((c + 1), '/')) != NULL) { *c = (char)0; --- nmh-0.27/sbr/path.c.security Sun Dec 14 04:27:26 1997 +++ nmh-0.27/sbr/path.c Sat Jul 18 14:04:47 1998 @@ -44,10 +44,10 @@ char buffer[BUFSIZ]; if (flag == TSUBCWF) { - sprintf (buffer, "%s/%s", getfolder (1), name); + snprintf (buffer, BUFSIZ, "%s/%s", getfolder (1), name); name = m_mailpath (buffer); compath (name); - sprintf (buffer, "%s/", m_maildir ("")); + snprintf (buffer, BUFSIZ, "%s/", m_maildir ("")); if (ssequal (buffer, name)) { cp = name; name = getcpy (name + strlen (buffer)); @@ -81,7 +81,7 @@ name += NCWD; if (strcmp (name, DOTDOT) == 0 || strcmp (name, PWD) == 0) { - sprintf (buffer, "%.*s", cp - pwds, pwds); + snprintf (buffer, BUFSIZ, "%.*s", cp - pwds, pwds); return getcpy (buffer); } @@ -90,7 +90,7 @@ else cp = ep; - sprintf (buffer, "%.*s/%s", cp - pwds, pwds, name); + snprintf (buffer, BUFSIZ, "%.*s/%s", cp - pwds, pwds, name); return getcpy (buffer); } --- nmh-0.27/sbr/seq_bits.c.security Wed Nov 26 18:41:45 1997 +++ nmh-0.27/sbr/seq_bits.c Sat Jul 18 14:04:47 1998 @@ -14,9 +14,9 @@ int i; static char buffer[BUFSIZ]; - strcpy (buffer, MBITS); + strncpy (buffer, MBITS, BUFSIZ); for (i = 0; mp->msgattrs[i]; i++) - sprintf (buffer + strlen (buffer), "%c%s", + snprintf (buffer + strlen (buffer), BUFSIZ-strlen(buffer), "%c%s", FFATTRSLOT + 1 + i, mp->msgattrs[i]); return buffer; --- nmh-0.27/zotnet/tws/dtime.c.security Sun May 17 12:51:43 1998 +++ nmh-0.27/zotnet/tws/dtime.c Sat Jul 18 16:42:50 1998 @@ -252,7 +252,7 @@ if (!tw) return NULL; - sprintf (buffer, "%.3s %.3s %02d %02d:%02d:%02d %.4d\n", + snprintf (buffer, 25, "%.3s %.3s %02d %02d:%02d:%02d %.4d\n", tw_dotw[tw->tw_wday], tw_moty[tw->tw_mon], tw->tw_mday, tw->tw_hour, tw->tw_min, tw->tw_sec, tw->tw_year < 100 ? tw->tw_year + 1900 : tw->tw_year); @@ -326,20 +326,20 @@ if ((tw->tw_flags & TW_SZONE) == TW_SZNIL) result[0] = '\0'; else - sprintf(result, " %s", dtimezone(tw->tw_zone, tw->tw_flags | flags)); + snprintf(result, 80, " %s", dtimezone(tw->tw_zone, tw->tw_flags | flags)); - sprintf(buffer, "%02d %s %0*d %02d:%02d:%02d%s", + snprintf(buffer, 80, "%02d %s %0*d %02d:%02d:%02d%s", tw->tw_mday, tw_moty[tw->tw_mon], tw->tw_year < 100 ? 2 : 4, tw->tw_year, tw->tw_hour, tw->tw_min, tw->tw_sec, result); if ((tw->tw_flags & TW_SDAY) == TW_SEXP) - sprintf (result, "%s, %s", tw_dotw[tw->tw_wday], buffer); + snprintf (result, 80, "%s, %s", tw_dotw[tw->tw_wday], buffer); else if ((tw->tw_flags & TW_SDAY) == TW_SNIL) strcpy (result, buffer); else - sprintf (result, "%s (%s)", buffer, tw_dotw[tw->tw_wday]); + snprintf (result, 80, "%s (%s)", buffer, tw_dotw[tw->tw_wday]); return result; } @@ -379,7 +379,7 @@ if (flags & TW_DST) hours += 1; #endif /* defined(DSTXXX) */ - sprintf (buffer, "%s%02d%02d", offset < 0 ? "-" : "+", abs (hours), abs (mins)); + snprintf (buffer, 10, "%s%02d%02d", offset < 0 ? "-" : "+", abs (hours), abs (mins)); return buffer; } --- nmh-0.27/zotnet/mf/mf.c.security Mon Jan 27 00:38:34 1997 +++ nmh-0.27/zotnet/mf/mf.c Sat Jul 18 16:46:41 1998 @@ -425,9 +425,9 @@ while (isspace (*ap)) ap++; if (cp) - sprintf (adr, "%.*s", cp - ap, ap); + snprintf (adr, BUFSIZ, "%.*s", cp - ap, ap); else - strcpy (adr, ap); + strncpy (adr, ap, BUFSIZ); bp = adr + strlen (adr) - 1; if (*bp == ',' || *bp == ';' || *bp == '\n') *bp = 0; @@ -484,7 +484,7 @@ return OK; /* why be choosy? */ default: - sprintf (err, "illegal address construct (%s)", buffer); + snprintf (err, BUFSIZ, "illegal address construct (%s)", buffer); return NOTOK; } @@ -503,13 +503,13 @@ return NOTOK; if (last_lex == LX_RBRK) return OK; - sprintf (err, "missing right-bracket (%s)", buffer); + snprintf (err, BUFSIZ, "missing right-bracket (%s)", buffer); return NOTOK; case LX_COLN: get_group: ; if (glevel++ > 0) { - sprintf (err, "nested groups not allowed (%s)", pers); + snprintf (err, BUFSIZ, "nested groups not allowed (%s)", pers); return NOTOK; } grp = add (": ", pers); @@ -538,7 +538,7 @@ goto more_phrase; default: - sprintf (err, "no mailbox in address, only a phrase (%s%s)", + snprintf (err, BUFSIZ, "no mailbox in address, only a phrase (%s%s)", pers, buffer); return NOTOK; } @@ -574,7 +574,7 @@ return OK; default: - sprintf (err, "junk after local@domain (%s)", buffer); + snprintf (err, BUFSIZ, "junk after local@domain (%s)", buffer); return NOTOK; } @@ -591,7 +591,7 @@ return OK; default: - sprintf (err, "missing mailbox (%s)", buffer); + snprintf (err, BUFSIZ, "missing mailbox (%s)", buffer); return NOTOK; } } @@ -639,7 +639,7 @@ return OK; default: - sprintf (err, "no at-sign after local-part (%s)", buffer); + snprintf (err, BUFSIZ, "no at-sign after local-part (%s)", buffer); return NOTOK; } } @@ -658,7 +658,7 @@ break; default: - sprintf (err, "no mailbox in local-part (%s)", buffer); + snprintf (err, BUFSIZ, "no mailbox in local-part (%s)", buffer); return NOTOK; } @@ -685,7 +685,7 @@ break; default: - sprintf (err, "no sub-domain in domain-part of address (%s)", buffer); + snprintf (err, BUFSIZ, "no sub-domain in domain-part of address (%s)", buffer); return NOTOK; } @@ -720,7 +720,7 @@ break; default: - sprintf (err, "no sub-domain in domain-part of address (%s)", buffer); + snprintf (err, BUFSIZ, "no sub-domain in domain-part of address (%s)", buffer); return NOTOK; } switch (my_lex (buffer)) { @@ -736,7 +736,7 @@ break; default: - sprintf (err, "no at-sign found for next domain in route (%s)", + snprintf (err, BUFSIZ, "no at-sign found for next domain in route (%s)", buffer); } break; @@ -753,7 +753,7 @@ return OK; default: - sprintf (err, "no colon found to terminate route (%s)", buffer); + snprintf (err, BUFSIZ, "no colon found to terminate route (%s)", buffer); return NOTOK; } } @@ -894,7 +894,7 @@ for (cp = p; *cp; cp++) for (i = 0; special[i].lx_chr; i++) if (*cp == special[i].lx_chr) { - sprintf (buffer, "\"%s\"", p); + snprintf (buffer, BUFSIZ, "\"%s\"", p); return buffer; } --- nmh-0.27/zotnet/bboards/getbbent.c.security Sun Feb 2 05:04:22 1997 +++ nmh-0.27/zotnet/bboards/getbbent.c Sat Jul 18 14:04:49 1998 @@ -100,7 +100,7 @@ if (BBuid == -1) return setbbinfo (BBOARDS, file, f); - strcpy (BBData, file); + strncpy (BBData, file, sizeof(BBData)); BBflags = SB_NULL; endbbent (); @@ -153,10 +153,10 @@ static int setpwaux (struct passwd *pw, char *file) { - strcpy (BBName, pw->pw_name); + strncpy (BBName, pw->pw_name, sizeof(BBName)); BBuid = pw->pw_uid; - strcpy (BBDir, pw->pw_dir); - sprintf (BBData, "%s/%s", + strncpy (BBDir, pw->pw_dir, sizeof(BBDir)); + snprintf (BBData,sizeof(BBData), "%s/%s", *file != '/' ? BBDir : "", *file != '/' ? file : file + 1); @@ -395,12 +395,12 @@ if (*bb->bb_request == '-') if (p == NULL && r && *r == '@') - sprintf (BBRequest, "%s%s%s", bb->bb_name, bb->bb_request, r); + snprintf (BBRequest, sizeof(BBRequest), "%s%s%s", bb->bb_name, bb->bb_request, r); else - sprintf (BBRequest, "%s%s", bb->bb_name, bb->bb_request); + snprintf (BBRequest, sizeof(BBRequest), "%s%s", bb->bb_name, bb->bb_request); else if (p == NULL && r && *r == '@' && *bb->bb_request) - sprintf (BBRequest, "%s%s", bb->bb_request, r); + snprintf (BBRequest, sizeof(BBRequest), "%s%s", bb->bb_request, r); if (BBRequest[0]) bb->bb_request = BBRequest; @@ -410,7 +410,7 @@ : bb->bb_leader[0]; if (*bb->bb_addr == '@') { - sprintf (BBAddr, "%s%s", bb->bb_name, bb->bb_addr); + snprintf (BBAddr, sizeof(BBAddr), "%s%s", bb->bb_name, bb->bb_addr); bb->bb_addr = BBAddr; } else @@ -420,22 +420,22 @@ if (*bb->bb_file == 0) return; if (*bb->bb_file != '/') { - sprintf (BBFile, "%s/%s", BBDir, bb->bb_file); + snprintf (BBFile, sizeof(BBFile), "%s/%s", BBDir, bb->bb_file); bb->bb_file = BBFile; } if ((cp = strrchr(bb->bb_file, '/')) == NULL || *++cp == 0) strcpy (prf, ""), cp = bb->bb_file; else - sprintf (prf, "%.*s", cp - bb->bb_file, bb->bb_file); + snprintf (prf, sizeof(prf),"%.*s", cp - bb->bb_file, bb->bb_file); if ((dp = strchr(cp, '.')) == NULL) dp = cp + strlen (cp); - sprintf (BBArchive, "%s%s/%s", prf, ARCHIVE, cp); + snprintf (BBArchive, sizeof(BBArchive), "%s%s/%s", prf, ARCHIVE, cp); bb->bb_archive = BBArchive; - sprintf (BBInfo, "%s.%.*s%s", prf, dp - cp, cp, CNTFILE); + snprintf (BBInfo, sizeof(BBInfo), "%s.%.*s%s", prf, dp - cp, cp, CNTFILE); bb->bb_info = BBInfo; - sprintf (BBMap, "%s.%.*s%s", prf, dp - cp, cp, MAPFILE); + snprintf (BBMap, sizeof(BBMap), "%s.%.*s%s", prf, dp - cp, cp, MAPFILE); bb->bb_map = BBMap; if ((info = fopen (bb->bb_info, "r")) == NULL) @@ -460,7 +460,7 @@ register char *p, **q, **r; static uid_t uid = 0; static gid_t gid = 0; - static char username[10] = ""; + static char username[16] = ""; register struct passwd *pw; register struct group *gr; @@ -473,7 +473,7 @@ if ((pw = getpwuid (uid = getuid ())) == NULL) return 0; gid = getgid (); - strcpy (username, pw->pw_name); + strncpy (username, pw->pw_name, sizeof(username)); } if (uid == BBuid) @@ -626,15 +626,15 @@ if ((cp = strrchr(bb->bb_file, '/')) == NULL || *++cp == 0) strcpy (prf, ""), cp = bb->bb_file; else - sprintf (prf, "%.*s", cp - bb->bb_file, bb->bb_file); + snprintf (prf, BUFSIZ, "%.*s", cp - bb->bb_file, bb->bb_file); if ((dp = strchr(cp, '.')) == NULL) dp = cp + strlen (cp); - sprintf (file, "%s.%.*s%s", prf, dp - cp, cp, DSTFILE); + snprintf (file, BUFSIZ, "%s.%.*s%s", prf, dp - cp, cp, DSTFILE); hp = file; break; default: - sprintf (file, "%s/%s", BBDir, item); + snprintf (file, BUFSIZ, "%s/%s", BBDir, item); hp = file; break; } @@ -656,12 +656,12 @@ default: if ((hp = strrchr(item, '@'))) { *hp++ = 0; - strcpy (mbox, item); - strcpy (host, hp); + strncpy (mbox, item, sizeof(mbox)); + strncpy (host, hp, sizeof(host)); *--hp = '@'; } else { - sprintf (mbox, "%s%s", DISTADR, bb->bb_name); + snprintf (mbox, sizeof(mbox), "%s%s", DISTADR, bb->bb_name); strcpy (host, item); } if ((result = (*action) (mbox, host))) --- nmh-0.27/mts/smtp/hosts.c.security Thu Jan 22 18:21:02 1998 +++ nmh-0.27/mts/smtp/hosts.c Sat Jul 18 14:04:47 1998 @@ -39,7 +39,7 @@ char **r; struct host *h; - for (p = name, q = site; *p; p++, q++) + for (p = name, q = site; *p; p++, q++ && q-site h_name; - strcpy (buffer, site); + strncpy (buffer, site, BUFSIZ); return buffer; } --- nmh-0.27/mts/smtp/smtp.c.security Wed Nov 26 19:39:35 1997 +++ nmh-0.27/mts/smtp/smtp.c Sat Jul 18 14:04:47 1998 @@ -76,7 +76,7 @@ #endif -#define MAXEHLO 20 +#define MAXEHLO 30 static int doingEHLO; char *EHLOkeys[MAXEHLO + 1]; @@ -247,7 +247,7 @@ if ((dp = strrchr(*ap, '/')) && *++dp == NULL) *--dp = NULL; - sprintf (sm_tmpfil, "%s/smtpXXXXXX", *ap); + snprintf (sm_tmpfil, sizeof(sm_tmpfil), "%s/smtpXXXXXX", *ap); mktemp (sm_tmpfil); if ((sd = creat (sm_tmpfil, 0600)) != NOTOK) { @@ -486,16 +486,17 @@ char *dp, *bp, *cp, s; char buffer[BUFSIZ], sender[BUFSIZ]; FILE *fp, *gp; + int len=BUFSIZ; gp = NULL; k = strlen (file) - sizeof(".bulk"); if ((fp = fopen (file, "r")) == NULL) { - sprintf (bp = sm_reply.text, "unable to read %s: ", file); + len-=snprintf (bp = sm_reply.text, BUFSIZ, "unable to read %s: ", file); bp += strlen (bp); if ((s = strerror (errno))) - strcpy (bp, s); + len-=snprinf(bp, len, "%s", s); else - sprintf (bp, "Error %d", errno); + len-=snprintf (bp, len, "Error %d", errno); sm_reply.length = strlen (sm_reply.text); sm_reply.code = NOTOK; return RP_BHST; @@ -520,10 +521,10 @@ fflush (stdout); } losing0: ; - sprintf (buffer, "%s.bad", file); + snprintf (buffer, BUFSIZ, "%s.bad", file); rename (file, buffer); if (gp) { - sprintf (buffer, "%*.*sA.bulk", k, k, file); + snprintf (buffer, BUFSIZ, "%*.*sA.bulk", k, k, file); unlink (buffer); fclose (gp); } @@ -557,13 +558,15 @@ for (dp = cp, i = cc - 1; i > 0; dp += cc, i -= cc) if ((cc = write (fileno (sm_wfp), dp, i)) == NOTOK) { + len=BUFSIZ; losing3: ; strcpy (bp = sm_reply.text, "error writing to server: "); bp += strlen (bp); + len -= strlen(bp); if ((s = strerror (errno))) - strcpy (bp, s); + len-=snprintf(bp, len, "%s", s); else - sprintf (bp, "unknown error %d", errno); + len-=snprintf (bp, len, "unknown error %d", errno); sm_reply.length = strlen (sm_reply.text); goto losing2; } @@ -627,7 +630,7 @@ break; if (gp == NULL) { int l; - sprintf (buffer, "%*.*sA.bulk", k, k, file); + snprintf (buffer, BUFSIZ, "%*.*sA.bulk", k, k, file); if ((gp = fopen (buffer, "w+")) == NULL) goto bad_data; fprintf (gp, "MAIL FROM:<>\r\nRCPT TO:%sDATA\r\n", sender); @@ -664,7 +667,7 @@ smtalk (SM_RSET, "RSET"); free (cp); if (gp) { - sprintf (buffer, "%*.*sA.bulk", k, k, file); + snprintf (buffer, BUFSIZ, "%*.*sA.bulk", k, k, file); unlink (buffer); fclose (gp); } @@ -708,12 +711,13 @@ for (dp = cp, i = cc; i > 0; dp += j, i -= j) if ((j = fread (cp, sizeof(*cp), i, fp)) == OK) { if (ferror (fp)) { - sprintf (bp = sm_reply.text, "error reading %s: ", file); + len=BUFSIZ; + len-=snprintf (bp = sm_reply.text, len, "error reading %s: ", file); bp += strlen (bp); if ((s = strerror (errno))) - strcpy (bp, s); + len-=snprintf(bp, len, "%s", s); else - sprintf (bp, "unknown error %d", errno); + len-=snprintf (bp, len, "unknown error %d", errno); sm_reply.length = strlen (sm_reply.text); goto losing2; } @@ -754,7 +758,7 @@ default: result = RP_NO; if (gp) { - sprintf (buffer, "%*.*sA.bulk", k, k, file); + snprintf (buffer, BUFSIZ, "%*.*sA.bulk", k, k, file); unlink (buffer); fclose (gp); gp = NULL; @@ -775,7 +779,7 @@ fseek (gp, 0L, SEEK_SET); } else { - sprintf (buffer, "%*.*sA.bulk", k, k, file); + snprintf (buffer, BUFSIZ, "%*.*sA.bulk", k, k, file); if ((gp = fopen (buffer, "w")) == NULL) break; } @@ -816,7 +820,7 @@ va_list ap; va_start(ap, fmt); - vsprintf (sm_reply.text, fmt, ap); + vsnprintf (sm_reply.text, BUFSIZ, fmt, ap); va_end(ap); sm_reply.length = strlen (sm_reply.text); @@ -834,7 +838,7 @@ char buffer[BUFSIZ]; va_start(ap, fmt); - vsprintf (buffer, fmt, ap); + vsnprintf (buffer, BUFSIZ, fmt, ap); va_end(ap); if (sm_debug) { @@ -854,18 +858,19 @@ fflush (sm_wfp); if (ferror (sm_wfp)) return sm_werror (); - sprintf (file, "%s%c.bulk", sm_tmpfil, + snprintf (file, BUFSIZ, "%s%c.bulk", sm_tmpfil, (char) (sm_ispool + 'a' - 1)); if (rename (sm_tmpfil, file) == NOTOK) { char *bp; - sprintf (bp = sm_reply.text, + int len=BUFSIZ; + len-=snprintf (bp = sm_reply.text, len, "error renaming %s to %s: ", sm_tmpfil, file); bp += strlen (bp); if ((s = strerror (errno))) - strcpy (bp, s); + len-=snprintf(bp, len, "%s", s); else - sprintf (bp, "unknown error %d", errno); + len-=snprintf (bp, len, "unknown error %d", errno); sm_reply.length = strlen (sm_reply.text); sm_reply.code = NOTOK; return RP_BHST; @@ -1012,6 +1017,7 @@ int i, code, cont, bc, rc, more; char *bp, *rp; char **ehlo, buffer[BUFSIZ]; + int len = BUFSIZ; if (doingEHLO) { static int at_least_once = 0; @@ -1091,10 +1097,14 @@ } if ((i = min (bc, rc)) > 0) { - strncpy (rp, bp, i); + if(len>i) + { + strncpy (rp, bp, i); + len-=i; + } rp += i, rc -= i; if (more && rc > strlen (sm_moreply) + 1) { - strcpy (sm_reply.text + rc, sm_moreply); + snprintf(sm_reply.text + rc, BUFSIZ-rc, "%s", sm_moreply); rc += strlen (sm_moreply); } } @@ -1193,7 +1203,7 @@ case RP_BHST: default: text = "BHST"; - sprintf (buffer, "[%s] %s", text, sm_reply.text); + snprintf (buffer, BUFSIZ, "[%s] %s", text, sm_reply.text); return buffer; case RP_PARM: @@ -1213,7 +1223,7 @@ break; } - sprintf (buffer, "[%s] %3d %s", text, sm_reply.code, sm_reply.text); + snprintf (buffer, BUFSIZ, "[%s] %3d %s", text, sm_reply.code, sm_reply.text); return buffer; } --- nmh-0.27/mts/sendmail/hosts.c.security Thu Jan 22 18:20:36 1998 +++ nmh-0.27/mts/sendmail/hosts.c Sat Jul 18 14:04:47 1998 @@ -39,7 +39,7 @@ char **r; struct host *h; - for (p = name, q = site; *p; p++, q++) + for (p = name, q = site; *p; p++, q++ && q-site < BUFSIZ) *q = isupper (*p) ? tolower (*p) : *p; *q = 0; q = site; --- nmh-0.27/mts/sendmail/sendmail.c.security Wed Nov 26 19:38:55 1997 +++ nmh-0.27/mts/sendmail/sendmail.c Sat Jul 18 14:04:47 1998 @@ -80,7 +80,7 @@ static int doingEHLO; -#define MAXEHLO 10 +#define MAXEHLO 20 /* 10 isnt enough nowdays */ char *EHLOkeys[MAXEHLO + 1]; /* @@ -428,7 +428,7 @@ va_list ap; va_start(ap, fmt); - vsprintf (sm_reply.text, fmt, ap); + vsnprintf (sm_reply.text, BUFSIZ, fmt, ap); va_end(ap); sm_reply.length = strlen (sm_reply.text); @@ -444,9 +444,10 @@ int result; char buffer[BUFSIZ]; va_list ap; + int len=BUFSIZ; va_start(ap, fmt); - vsprintf (buffer, fmt, ap); + vsnprintf (buffer, BUFSIZ, fmt, ap); va_end(ap); if (sm_debug) { @@ -466,18 +467,18 @@ fflush (sm_wfp); if (ferror (sm_wfp)) return sm_werror (); - sprintf (file, "%s%c.bulk", sm_tmpfil, + snprintf (file, BUFSIZ, "%s%c.bulk", sm_tmpfil, (char) (sm_ispool + 'a' - 1)); if (rename (sm_tmpfil, file) == NOTOK) { char *bp; - sprintf (bp = sm_reply.text, + len-=snprintf (bp = sm_reply.text, BUFSIZ, "error renaming %s to %s: ", sm_tmpfil, file); bp += strlen (bp); if ((s = strerror (errno))) - strcpy (bp, s); - else - sprintf (bp, "unknown error %d", errno); + len-=snprintf(bp, len, "%s",s); + else + len-=snprintf (bp, len, "unknown error %d", errno); sm_reply.length = strlen (sm_reply.text); sm_reply.code = NOTOK; return RP_BHST; @@ -694,8 +695,11 @@ strncpy (rp, bp, i); rp += i, rc -= i; if (more && rc > strlen (sm_moreply) + 1) { - strcpy (sm_reply.text + rc, sm_moreply); - rc += strlen (sm_moreply); + if(rchghmsg; j > msgnum; i--, j--) { - strcpy (f1, m_name (i)); - strcpy (f2, m_name (j)); + strncpy (f1, m_name (i), BUFSIZ); + strncpy (f2, m_name (j), BUFSIZ); if (does_exist (mp, j)) { if (verbosw) printf ("message %d becomes message %d\n", j, i); @@ -313,8 +313,8 @@ /* new hghmsg is hghmsg + numburst */ i = inplace ? msgnum + numburst : mp->hghmsg; for (j = numburst; j >= (inplace ? 0 : 1); i--, j--) { - strcpy (f1, m_name (i)); - strcpy (f2, m_scratch ("", invo_name)); + strncpy (f1, m_name (i), BUFSIZ); + strncpy (f2, m_scratch ("", invo_name), BUFSIZ); if (verbosw && i != msgnum) printf ("message %d of digest %d becomes message %d\n", j, msgnum, i); @@ -327,7 +327,7 @@ fclose (out); if (i == msgnum) { - strcpy (f3, m_backup (f1)); + strncpy (f3, m_backup (f1), BUFSIZ); if (rename (f1, f3) == NOTOK) admonish (f3, "unable to rename %s to", f1); } --- nmh-0.27/uip/comp.c.security Wed Jul 1 00:14:37 1998 +++ nmh-0.27/uip/comp.c Sat Jul 18 16:25:17 1998 @@ -80,13 +80,13 @@ setlocale(LC_ALL, ""); #endif invo_name = r1bindex (argv[0], '/'); - if ((cp = context_find (invo_name))) { + if ((cp = context_find (invo_name)) != NULL) { ap = brkstring (cp = getcpy (cp), " ", "\n"); - ap = copyip (ap, arguments); + ap = copyip_n(ap, arguments, BUFSIZ); } else { ap = arguments; } - copyip (argv + 1, ap); + copyip_n(argv + 1, ap, BUFSIZ); argp = arguments; while ((cp = *argp++)) { @@ -99,7 +99,7 @@ adios (NULL, "-%s unknown", cp); case HELPSW: - sprintf (buf, "%s [+folder] [msg] [switches]", invo_name); + snprintf (buf, BUFSIZ, "%s [+folder] [msg] [switches]", invo_name); print_help (buf, switches, 1); done (1); case VERSIONSW: @@ -179,7 +179,7 @@ cwd = getcpy (pwd ()); - if (!context_find ("path")) + if (context_find ("path") == NULL) free (path ("./", TFOLDER)); /* Check if we are using a draft folder */ @@ -235,7 +235,7 @@ } try_it_again: - strcpy (drft, m_draft (dfolder, file, use, &isdf)); + strncpy (drft, m_draft (dfolder, file, use, &isdf), BUFSIZ); /* * Check if we have an existing draft --- nmh-0.27/uip/conflict.c.security Wed Jan 14 21:07:48 1998 +++ nmh-0.27/uip/conflict.c Sat Jul 18 14:04:48 1998 @@ -61,7 +61,7 @@ { int akp = 0, dp = 0; char *cp, **argp = argv + 1; - char buf[80], *akv[50]; + char buf[BUFSIZ], *akv[50]; #ifdef LOCALE setlocale(LC_ALL, ""); @@ -83,7 +83,7 @@ adios (NULL, "-%s unknown", cp); case HELPSW: - sprintf (buf, "%s [switches] [aliasfiles ...]", invo_name); + snprintf (buf, BUFSIZ, "%s [switches] [aliasfiles ...]", invo_name); print_help (buf, switches, 0); done (1); case VERSIONSW: @@ -539,3 +539,4 @@ fprintf (out, "all group leaders accounted for\n"); } #endif /* UCI */ + --- nmh-0.27/uip/dist.c.security Wed Jul 1 00:15:07 1998 +++ nmh-0.27/uip/dist.c Sat Jul 18 16:25:35 1998 @@ -73,7 +73,7 @@ int nwhat = 0, i, in, isdf = 0, out; char *cp, *cwd, *maildir, *msgnam, *dfolder = NULL; char *dmsg = NULL, *ed = NULL, *file = NULL, *folder = NULL; - char *form = NULL, *msg = NULL, buf[100], drft[BUFSIZ]; + char *form = NULL, *msg = NULL, buf[BUFSIZ], drft[BUFSIZ]; char **ap, **argp, *arguments[MAXARGS]; struct msgs *mp = NULL; struct stat st; @@ -82,13 +82,13 @@ setlocale(LC_ALL, ""); #endif invo_name = r1bindex (argv[0], '/'); - if ((cp = context_find (invo_name))) { + if ((cp = context_find (invo_name)) != NULL) { ap = brkstring (cp = getcpy (cp), " ", "\n"); - ap = copyip (ap, arguments); + ap = copyip_n(ap, arguments, MAXARGS); } else { ap = arguments; } - copyip (argv + 1, ap); + copyip_n(argv + 1, ap, MAXARGS); argp = arguments; while ((cp = *argp++)) { @@ -101,7 +101,7 @@ adios (NULL, "-%s unknown", cp); case HELPSW: - sprintf (buf, "%s [+folder] [msg] [switches]", invo_name); + snprintf (buf, BUFSIZ, "%s [+folder] [msg] [switches]", invo_name); print_help (buf, switches, 1); done (1); case VERSIONSW: @@ -187,7 +187,7 @@ cwd = getcpy (pwd ()); - if (!context_find ("path")) + if (context_find ("path") == NULL) free (path ("./", TFOLDER)); if (file && (msg || folder)) adios (NULL, "can't mix files and folders/msgs"); @@ -202,7 +202,7 @@ } try_it_again: - strcpy (drft, m_draft (dfolder, dmsg, NOUSE, &isdf)); + strncpy (drft, m_draft (dfolder, dmsg, NOUSE, &isdf), BUFSIZ); /* Check if draft already exists */ if (stat (drft, &st) != NOTOK) { --- nmh-0.27/uip/distsbr.c.security Wed Dec 17 02:09:47 1997 +++ nmh-0.27/uip/distsbr.c Sat Jul 18 14:04:48 1998 @@ -49,9 +49,9 @@ case FLDPLUS: case FLDEOF: if (uprf (name, "distribute-")) - sprintf (name, "%s%s", "Resent", &name[10]); + snprintf (name, NAMESZ, "%s%s", "Resent", &name[10]); if (uprf (name, "distribution-")) - sprintf (name, "%s%s", "Resent", &name[12]); + snprintf (name, NAMESZ, "%s%s", "Resent", &name[12]); if (!uprf (name, "resent")) { advise (NULL, BADHDR, "draft", name); goto leave_bad; @@ -135,7 +135,7 @@ if ((ifp = fopen (msgnam, "r")) == NULL) adios (msgnam, "unable to open message"); - strcpy (tmpfil, m_tmpfil ("dist")); + strncpy (tmpfil, m_tmpfil ("dist"), BUFSIZ); if ((hdrfd = open (tmpfil, O_RDWR | O_CREAT | O_TRUNC, 0600)) == NOTOK) adios (tmpfil, "unable to re-open temporary file"); if ((out = dup (hdrfd)) == NOTOK @@ -165,7 +165,7 @@ case BODYEOF: fclose (ofp); - strcpy (tmpfil, m_tmpfil ("dist")); + strncpy (tmpfil, m_tmpfil ("dist"), BUFSIZ); if ((txtfd = open (tmpfil, O_RDWR | O_CREAT | O_TRUNC, 0600)) == NOTOK) adios (tmpfil, "unable to open temporary file"); if ((out = dup (txtfd)) == NOTOK --- nmh-0.27/uip/dp.c.security Wed Jan 14 21:08:15 1998 +++ nmh-0.27/uip/dp.c Sat Jul 18 16:25:47 1998 @@ -50,20 +50,20 @@ { int datep = 0, width = 0, status = 0; char *cp, *form = NULL, *format = NULL, *nfs; - char buf[80], **ap, **argp, *arguments[MAXARGS]; + char buf[BUFSIZ], **ap, **argp, *arguments[MAXARGS]; char *dates[NDATES]; #ifdef LOCALE setlocale(LC_ALL, ""); #endif invo_name = r1bindex (argv[0], '/'); - if ((cp = context_find (invo_name))) { + if ((cp = context_find (invo_name)) != NULL) { ap = brkstring (cp = getcpy (cp), " ", "\n"); - ap = copyip (ap, arguments); + ap = copyip_n(ap, arguments, MAXARGS); } else { ap = arguments; } - copyip (argv + 1, ap); + copyip_n(argv + 1, ap, MAXARGS); argp = arguments; while ((cp = *argp++)) { @@ -76,7 +76,7 @@ adios (NULL, "-%s unknown", cp); case HELPSW: - sprintf (buf, "%s [switches] dates ...", invo_name); + snprintf (buf, BUFSIZ, "%s [switches] dates ...", invo_name); print_help (buf, switches, 1); done (1); case VERSIONSW: --- nmh-0.27/uip/dropsbr.c.security Fri Feb 13 00:57:21 1998 +++ nmh-0.27/uip/dropsbr.c Sat Jul 18 14:04:48 1998 @@ -355,12 +355,12 @@ char tmpbuffer[BUFSIZ]; char *tp, *ep, *fp; - strcpy(tmpbuffer, buffer); + strncpy(tmpbuffer, buffer, BUFSIZ); ep = tmpbuffer + 13; if (!(fp = strchr(ep + 1, ' '))) fp = strchr(ep + 1, '\n'); tp = dctime(dlocaltimenow()); - sprintf (buffer, "From %.*s %s", fp - ep, ep, tp); + snprintf (buffer, BUFSIZ, "From %.*s %s", fp - ep, ep, tp); } else if (!strncmp (buffer, "X-Envelope-From:", 16)) { /* * Change the "X-Envelope-From:" field @@ -369,9 +369,9 @@ char tmpbuffer[BUFSIZ]; char *ep; - strcpy(tmpbuffer, buffer); + strncpy(tmpbuffer, buffer, BUFSIZ); ep = tmpbuffer + 17; - sprintf (buffer, "From %s", ep); + snprintf (buffer, BUFSIZ, "From %s", ep); } else if (strncmp (buffer, "From ", 5)) { /* * If there is already a "From " line, @@ -380,11 +380,11 @@ char tmpbuffer[BUFSIZ]; char *tp, *ep; - strcpy(tmpbuffer, buffer); + strncpy(tmpbuffer, buffer, BUFSIZ); ep = "nobody@nowhere"; tp = dctime(dlocaltimenow()); - sprintf (buffer, "From %s %s", ep, tp); - strcat (buffer, tmpbuffer); + snprintf (buffer, BUFSIZ, "From %s %s", ep, tp); + strncat (buffer, tmpbuffer, BUFSIZ-strlen(buffer)); } } @@ -469,9 +469,9 @@ if ((dp = strchr(cp = r1bindex (file, '/'), '.')) == NULL) dp = cp + strlen (cp); if (cp == file) - sprintf (buffer, ".%.*s%s", dp - cp, cp, ".map"); + snprintf (buffer, BUFSIZ, ".%.*s%s", dp - cp, cp, ".map"); else - sprintf (buffer, "%.*s.%.*s%s", cp - file, file, dp - cp, cp, ".map"); + snprintf (buffer, BUFSIZ, "%.*s.%.*s%s", cp - file, file, dp - cp, cp, ".map"); return buffer; } --- nmh-0.27/uip/flist.c.security Fri May 8 13:02:18 1998 +++ nmh-0.27/uip/flist.c Sat Jul 18 14:04:48 1998 @@ -114,7 +114,7 @@ char *cp, **ap; char **argp, **lastArg; char *arguments[MAXARGS]; - char buf[100]; + char buf[BUFSIZ]; #ifdef LOCALE setlocale(LC_ALL, ""); @@ -130,11 +130,11 @@ if ((cp = context_find(invo_name)) != NULL) { ap = brkstring(cp = getcpy(cp), " ", "\n"); - ap = copyip(ap, arguments); + ap = copyip_n(ap, arguments, MAXARGS); } else { ap = arguments; } - lastArg = copyip(argv + 1, ap); + lastArg = copyip_n(argv + 1, ap, MAXARGS); argp = arguments; argc = lastArg - argp; foldersToDo = (char **) malloc(argc * sizeof(char *)); @@ -150,7 +150,7 @@ adios(NULL, "-%s unknown", cp); case HELPSW: - sprintf(buf, "%s [+folder1 [+folder2 ...]][switches]", invo_name); + snprintf(buf, BUFSIZ, "%s [+folder1 [+folder2 ...]][switches]", invo_name); print_help(buf, switches, 1); done(1); case VERSIONSW: @@ -278,7 +278,7 @@ if (nFoldersToDo > 0) { /* Update context */ - strcpy (curfolder, foldersToDo[nFoldersToDo - 1]); + strncpy (curfolder, foldersToDo[nFoldersToDo - 1], BUFSIZ); context_replace (pfolder, curfolder);/* update current folder */ context_save (); /* save the context file */ @@ -379,10 +379,10 @@ } if (dp->d_name[0] == '.') continue; - strcpy(name, base); + strncpy(name, base, sizeof(name)-2); if (*base) strcat(name, "/"); - strcat(name, dp->d_name); + strncat(name, dp->d_name, sizeof(name)-strlen(name)); if ((stat(name, &st) != -1) && S_ISDIR(st.st_mode)) { /* * Check if this was really a symbolic link pointing @@ -501,9 +501,9 @@ for (i = 0; i < nFolders; ++i) { /* Add `+' to end of name of current folder */ if (strcmp(curfolder, folders[i].name)) - sprintf(tmpname, "%s", folders[i].name); + snprintf(tmpname, BUFSIZ, "%s", folders[i].name); else - sprintf(tmpname, "%s+", folders[i].name); + snprintf(tmpname, BUFSIZ, "%s+", folders[i].name); if (folders[i].error) { printf("%-*s is unreadable\n", maxlen+1, tmpname); @@ -610,7 +610,7 @@ char atrcur[BUFSIZ]; register struct node *np; - sprintf (atrcur, "atr-%s-", current); + snprintf (atrcur, BUFSIZ, "atr-%s-", current); atrlen = strlen (atrcur); context_read (); --- nmh-0.27/uip/fmtdump.c.security Sun Jan 25 05:31:29 1998 +++ nmh-0.27/uip/fmtdump.c Sat Jul 18 16:25:59 1998 @@ -44,7 +44,7 @@ { int ncomps; char *cp, *form = NULL, *format = NULL; - char buf[100], **ap, **argp; + char buf[BUFSIZ], **ap, **argp; char *nfs, *arguments[MAXARGS]; struct format *fmt; @@ -52,13 +52,13 @@ setlocale(LC_ALL, ""); #endif invo_name = r1bindex (argv[0], '/'); - if ((cp = context_find (invo_name))) { + if ((cp = context_find (invo_name)) != NULL) { ap = brkstring (cp = getcpy (cp), " ", "\n"); - ap = copyip (ap, arguments); + ap = copyip_n(ap, arguments, BUFSIZ); } else { ap = arguments; } - copyip (argv + 1, ap); + copyip_n(argv + 1, ap, BUFSIZ); argp = arguments; while ((cp = *argp++)) { @@ -71,7 +71,7 @@ adios (NULL, "-%s unknown", cp); case HELPSW: - sprintf (buf, "%s [switches]", invo_name); + snprintf (buf, BUFSIZ,"%s [switches]", invo_name); print_help (buf, switches, 1); done (1); case VERSIONSW: @@ -434,7 +434,8 @@ case FT_V_MATCH: return("V_MATCH"); case FT_V_AMATCH: return("V_AMATCH"); default: - printf(buf, "/* ??? #%d */", t); + /* Note - this isnt just security it was *wrong* in the original - AC*/ + snprintf(buf, sizeof(buf), "/* ??? #%d */", t); return(buf); } } --- nmh-0.27/uip/folder.c.security Sun Jun 7 16:00:33 1998 +++ nmh-0.27/uip/folder.c Sat Jul 18 16:28:40 1998 @@ -132,7 +132,7 @@ int printsw = 0, listsw = 0; int pushsw = 0, popsw = 0; char *cp, *dp, *msg = NULL, *argfolder = NULL; - char **ap, **argp, buf[100], *arguments[MAXARGS]; + char **ap, **argp, buf[BUFSIZ], *arguments[MAXARGS]; struct stat st; #ifdef LOCALE @@ -147,13 +147,13 @@ if (argv[0][strlen (argv[0]) - 1] == 's') all = 1; - if ((cp = context_find (invo_name))) { + if ((cp = context_find (invo_name)) != NULL) { ap = brkstring (cp = getcpy (cp), " ", "\n"); - ap = copyip (ap, arguments); + ap = copyip_n(ap, arguments, MAXARGS); } else { ap = arguments; } - copyip (argv + 1, ap); + copyip_n(argv + 1, ap, MAXARGS); argp = arguments; while ((cp = *argp++)) { @@ -166,7 +166,7 @@ adios (NULL, "-%s unknown", cp); case HELPSW: - sprintf (buf, "%s [+folder] [msg] [switches]", invo_name); + snprintf (buf, BUFSIZ, "%s [+folder] [msg] [switches]", invo_name); print_help (buf, switches, 1); done (1); case VERSIONSW: @@ -269,7 +269,7 @@ } } - if (!context_find ("path")) + if (context_find ("path") == NULL) free (path ("./", TFOLDER)); nmhdir = concat (m_maildir (""), "/", NULL); @@ -285,7 +285,7 @@ if (!argfolder) { /* If no folder is given, the current folder and */ /* the top of the folder stack are swapped. */ - if ((cp = context_find (stack))) { + if ((cp = context_find (stack)) != NULL) { dp = getcpy (cp); ap = brkstring (dp, " ", "\n"); argfolder = getcpy(*ap++); @@ -309,7 +309,7 @@ if (popsw) { if (argfolder) adios (NULL, "sorry, no folders allowed with -pop"); - if ((cp = context_find (stack))) { + if ((cp = context_find (stack)) != NULL) { dp = getcpy (cp); ap = brkstring (dp, " ", "\n"); argfolder = getcpy(*ap++); @@ -339,7 +339,7 @@ /* Listing the folder stack */ if (listsw) { printf ("%s", argfolder ? argfolder : getfolder (1)); - if ((cp = context_find (stack))) { + if ((cp = context_find (stack)) != NULL) { dp = getcpy (cp); for (ap = brkstring (dp, " ", "\n"); *ap; ap++) printf (" %s", *ap); @@ -388,13 +388,13 @@ dodir (folder); } } else { - strcpy (folder, argfolder ? argfolder : getfolder (1)); + strncpy (folder, argfolder ? argfolder : getfolder (1), BUFSIZ); /* * Check if folder exists. If not, then see if * we should create it, or just exit. */ - if (stat (strcpy (buf, m_maildir (folder)), &st) == -1) { + if (stat (strncpy (buf, m_maildir (folder), BUFSIZ), &st) == -1) { if (errno != ENOENT) adios (buf, "error on folder"); if (fcreat == 0) { @@ -444,7 +444,7 @@ if (chdir (nmhdir) == NOTOK) adios (nmhdir, "unable to change directory to"); - addir (strcpy (buffer, dir)); + addir (strncpy (buffer, dir, BUFSIZ)); for (i = start; i < foldp; i++) { get_folder_info (folds[i], NULL); @@ -609,9 +609,9 @@ /* Add `+' to end of name, if folder is current */ if (strcmp (folder, fi[i].name)) - sprintf (tmpname, "%s", fi[i].name); + snprintf (tmpname, BUFSIZ, "%s", fi[i].name); else - sprintf (tmpname, "%s+", fi[i].name); + snprintf (tmpname, BUFSIZ, "%s+", fi[i].name); if (fi[i].error) { printf ("%-*s is unreadable\n", maxlen+1, tmpname); @@ -809,7 +809,7 @@ char atrcur[BUFSIZ]; register struct node *np; - sprintf (atrcur, "atr-%s-", current); + snprintf (atrcur, BUFSIZ, "atr-%s-", current); atrlen = strlen (atrcur); context_read (); --- nmh-0.27/uip/forw.c.security Wed Jul 1 00:16:26 1998 +++ nmh-0.27/uip/forw.c Sat Jul 18 16:29:17 1998 @@ -125,7 +125,7 @@ char *cp, *cwd, *maildir, *dfolder = NULL; char *dmsg = NULL, *digest = NULL, *ed = NULL; char *file = NULL, *filter = NULL, *folder = NULL; - char *form = NULL, buf[100], value[10], **ap; + char *form = NULL, buf[BUFSIZ], value[10], **ap; char **argp, *arguments[MAXARGS], *msgs[MAXARGS]; struct stat st; @@ -137,13 +137,13 @@ setlocale(LC_ALL, ""); #endif invo_name = r1bindex (argv[0], '/'); - if ((cp = context_find (invo_name))) { + if ((cp = context_find (invo_name)) != NULL) { ap = brkstring (cp = getcpy (cp), " ", "\n"); - ap = copyip (ap, arguments); + ap = copyip_n(ap, arguments, BUFSIZ); } else { ap = arguments; } - copyip (argv + 1, ap); + copyip_n(argv + 1, ap, BUFSIZ); argp = arguments; while ((cp = *argp++)) { @@ -156,7 +156,7 @@ adios (NULL, "-%s unknown", cp); case HELPSW: - sprintf (buf, "%s [+folder] [msgs] [switches]", invo_name); + snprintf (buf, BUFSIZ, "%s [+folder] [msgs] [switches]", invo_name); print_help (buf, switches, 1); done (1); case VERSIONSW: @@ -289,7 +289,7 @@ cwd = getcpy (pwd ()); - if (!context_find ("path")) + if (context_find ("path") == NULL) free (path ("./", TFOLDER)); if (file && (msgp || folder)) adios (NULL, "can't mix files and folders/msgs"); @@ -297,13 +297,13 @@ try_it_again: #ifdef MHE - strcpy (drft, buildsw ? m_maildir ("draft") - : m_draft (dfolder, NULL, NOUSE, &isdf)); + strncpy (drft, buildsw ? m_maildir ("draft") + : m_draft (dfolder, NULL, NOUSE, &isdf), BUFSIZ); /* Check if a draft already exists */ if (!buildsw && stat (drft, &st) != NOTOK) { #else - strcpy (drft, m_draft (dfolder, dmsg, NOUSE, &isdf)); + strncpy (drft, m_draft (dfolder, dmsg, NOUSE, &isdf), BUFSIZ); /* Check if a draft already exists */ if (stat (drft, &st) != NOTOK) { @@ -371,7 +371,7 @@ */ if (digest) { if (issue == 0) { - sprintf (buf, IFORMAT, digest); + snprintf (buf, BUFSIZ,IFORMAT, digest); if (volume == 0 && (cp = context_find (buf)) && ((issue = atoi (cp)) < 0)) @@ -379,7 +379,7 @@ issue++; } if (volume == 0) - sprintf (buf, VFORMAT, digest); + snprintf (buf, BUFSIZ, VFORMAT, digest); if ((cp = context_find (buf)) == NULL || (volume = atoi (cp)) <= 0) volume = 1; if (!form) @@ -426,10 +426,10 @@ close (out); if (digest) { - sprintf (buf, IFORMAT, digest); + snprintf (buf, BUFSIZ, IFORMAT, digest); sprintf (value, "%d", issue); context_replace (buf, getcpy (value)); - sprintf (buf, VFORMAT, digest); + snprintf (buf, BUFSIZ, VFORMAT, digest); sprintf (value, "%d", volume); context_replace (buf, getcpy (value)); } @@ -507,7 +507,7 @@ if (mp->numsel >= MAXARGS - i) adios (NULL, "more than %d messages for %s exec", vec[0], MAXARGS - i); - for (msgnum = mp->lowsel; msgnum <= mp->hghsel; msgnum++) + for (msgnum = mp->lowsel; msgnum <= mp->hghsel && ilowsel; msgnum <= mp->hghsel; msgnum++) { if (is_selected (mp, msgnum)) { if (digest) - strcpy (buffer, msgnum == mp->lowsel ? delim3 : delim4); + strncpy (buffer, msgnum == mp->lowsel ? delim3 : delim4, BUFSIZ); else { - strcpy (bp = buffer, "\n-------"), bp += strlen (bp); + strncpy (bp = buffer, "\n-------", BUFSIZ-3), bp += strlen (bp); if (msgnum == mp->lowsel) - sprintf (bp, " Forwarded Message%s", mp->numsel > 1 ? "s" : ""); + snprintf (bp, BUFSIZ-(bp-buffer)-2," Forwarded Message%s", mp->numsel > 1 ? "s" : ""); else - sprintf (bp, " Message %d", msgcnt); + snprintf (bp, BUFSIZ-(bp-buffer)-2, " Message %d", msgcnt); bp += strlen (bp); strcpy (bp, "\n\n"); } @@ -578,13 +578,13 @@ if (digest) { strcpy (buffer, delim4); } else { - sprintf (buffer, "\n------- End of Forwarded Message%s\n\n", + snprintf (buffer, BUFSIZ, "\n------- End of Forwarded Message%s\n\n", mp->numsel > 1 ? "s" : ""); } write (out, buffer, strlen (buffer)); if (digest) { - sprintf (buffer, "End of %s Digest [Volume %d Issue %d]\n", digest, volume, issue); + snprintf (buffer, BUFSIZ, "End of %s Digest [Volume %d Issue %d]\n", digest, volume, issue); i = strlen (buffer); for (bp = buffer + i; i > 1; i--) *bp++ = '*'; @@ -605,12 +605,12 @@ int msgnum; char buffer[BUFSIZ]; - sprintf (buffer, "#forw [forwarded message%s] +%s", + snprintf (buffer, BUFSIZ, "#forw [forwarded message%s] +%s", mp->numsel == 1 ? "" : "s", mp->foldpath); write (out, buffer, strlen (buffer)); for (msgnum = mp->lowsel; msgnum <= mp->hghsel; msgnum++) if (is_selected (mp, msgnum)) { - sprintf (buffer, " %s", m_name (msgnum)); + snprintf (buffer, BUFSIZ, " %s", m_name (msgnum)); write (out, buffer, strlen (buffer)); } write (out, "\n", 1); @@ -647,7 +647,7 @@ dat[3] = fmtsize; dat[4] = 0; - strcpy (tmpfil, m_tmpfil (invo_name)); + strncpy (tmpfil, m_tmpfil (invo_name), BUFSIZ); if ((tmp = fopen (tmpfil, "w+")) == NULL) adios (tmpfil, "unable to create"); unlink (tmpfil); --- nmh-0.27/uip/ftpsbr.c.security Wed Feb 25 17:29:11 1998 +++ nmh-0.27/uip/ftpsbr.c Sat Jul 18 14:04:48 1998 @@ -99,6 +99,7 @@ { register int eindex; char *fmt; + int len=BUFSIZ; eindex = errno; @@ -106,7 +107,7 @@ fmt = va_arg (ap, char *); if (fmt) { - vsprintf(bp, fmt, ap); + len-=vsnprintf(bp, len, fmt, ap); bp += strlen(bp); } @@ -114,13 +115,16 @@ char *s; if (*what) { - sprintf (bp, " %s: ", what); + len-=snprintf (bp, len, " %s: ", what); bp += strlen (bp); } if ((s = strerror(eindex))) - strcpy (bp, s); + { + strncpy (bp, s, len); + len-=strlen(s); + } else - sprintf (bp, "Error %d", eindex); + len-=snprintf(bp, len,"Error %d", eindex); bp += strlen (bp); } --- nmh-0.27/uip/inc.c.security Sat May 16 17:28:30 1998 +++ nmh-0.27/uip/inc.c Sat Jul 18 16:29:50 1998 @@ -165,7 +165,7 @@ char *format = NULL, *form = NULL; char *newmail, *host = NULL; char *audfile = NULL, *from = NULL; - char buf[100], **ap; + char buf[BUFSIZ], **ap; char **argp, *nfs, *arguments[MAXARGS]; char *user = NULL; struct msgs *mp; @@ -218,13 +218,13 @@ snoop++; #endif /* POP */ - if ((cp = context_find (invo_name))) { + if ((cp = context_find (invo_name)) != NULL) { ap = brkstring (cp = getcpy (cp), " ", "\n"); - ap = copyip (ap, arguments); + ap = copyip_n (ap, arguments, MAXARGS); } else { ap = arguments; } - copyip (argv + 1, ap); + copyip_n (argv + 1, ap, MAXARGS); argp = arguments; while ((cp = *argp++)) { @@ -237,7 +237,7 @@ adios (NULL, "-%s unknown", cp); case HELPSW: - snprintf (buf, 100, "%s [+folder] [switches]", invo_name); + snprintf (buf, BUFSIZ, "%s [+folder] [switches]", invo_name); print_help (buf, switches, 1); done (1); case VERSIONSW: @@ -450,7 +450,7 @@ goto go_to_it; #endif /* POP */ - if (!context_find ("path")) + if (context_find ("path") == NULL) free (path ("./", TFOLDER)); if (!folder) folder = getfolder (0); @@ -532,7 +532,7 @@ } #ifdef MHE - if (context_find ("mhe")) { + if (context_find ("mhe") != NULL) { cp = concat (maildir, "/++", NULL); i = stat (cp, &st); if ((mhe = fopen (cp, "a")) == NULL) --- nmh-0.27/uip/install-mh.c.security Tue Jun 30 22:47:48 1998 +++ nmh-0.27/uip/install-mh.c Sat Jul 18 14:04:48 1998 @@ -38,7 +38,7 @@ { int i, autof = 0; char *cp, *path; - char buf[100], *dp; + char buf[BUFSIZ], *dp; char *arguments[MAXARGS], **argp; struct node *np; struct passwd *pw; @@ -49,7 +49,7 @@ setlocale(LC_ALL, ""); #endif invo_name = r1bindex (argv[0], '/'); - copyip (argv + 1, arguments); + copyip_n (argv + 1, arguments, MAXARGS); argp = arguments; while ((dp = *argp++)) { @@ -62,7 +62,7 @@ adios (NULL, "-%s unknown\n", dp); case HELPSW: - sprintf (buf, "%s [switches]", invo_name); + snprintf (buf, BUFSIZ, "%s [switches]", invo_name); print_help (buf, switches, 0); done (1); case VERSIONSW: --- nmh-0.27/uip/mark.c.security Wed Jan 14 21:09:46 1998 +++ nmh-0.27/uip/mark.c Sat Jul 18 16:30:08 1998 @@ -48,7 +48,7 @@ int addsw = 0, deletesw = 0, debugsw = 0; int listsw = 0, publicsw = -1, zerosw = 0; int seqp = 0, msgp = 0, msgnum; - char *cp, *maildir, *folder = NULL, buf[100]; + char *cp, *maildir, *folder = NULL, buf[BUFSIZ]; char **ap, **argp, *arguments[MAXARGS]; char *seqs[NUMATTRS + 1], *msgs[MAXARGS]; struct msgs *mp; @@ -57,13 +57,13 @@ setlocale(LC_ALL, ""); #endif invo_name = r1bindex (argv[0], '/'); - if ((cp = context_find (invo_name))) { + if ((cp = context_find (invo_name)) != NULL) { ap = brkstring (cp = getcpy (cp), " ", "\n"); - ap = copyip (ap, arguments); + ap = copyip_n(ap, arguments, MAXARGS); } else { ap = arguments; } - copyip (argv + 1, ap); + copyip_n(argv + 1, ap, MAXARGS); argp = arguments; while ((cp = *argp++)) { @@ -76,7 +76,7 @@ adios (NULL, "-%s unknown\n", cp); case HELPSW: - sprintf (buf, "%s [+folder] [msgs] [switches]", invo_name); + snprintf (buf, BUFSIZ, "%s [+folder] [msgs] [switches]", invo_name); print_help (buf, switches, 1); done (1); case VERSIONSW: @@ -146,7 +146,7 @@ listsw++; } - if (!context_find ("path")) + if (context_find ("path") == NULL) free (path ("./", TFOLDER)); if (!msgp) msgs[msgp++] = listsw ? "all" :"cur"; --- nmh-0.27/uip/mhbuild.c.security Sun Jun 21 21:41:42 1998 +++ nmh-0.27/uip/mhbuild.c Sat Jul 18 16:30:56 1998 @@ -122,7 +122,7 @@ { int sizesw = 1, headsw = 1; int *icachesw; - char *cp, buf[100]; + char *cp, buf[BUFSIZ]; char buffer[BUFSIZ], *compfile = NULL; char **ap, **argp, *arguments[MAXARGS]; CT ct, cts[2]; @@ -133,13 +133,13 @@ #endif invo_name = r1bindex (argv[0], '/'); - if ((cp = context_find (invo_name))) { + if ((cp = context_find (invo_name)) != NULL) { ap = brkstring (cp = getcpy (cp), " ", "\n"); - ap = copyip (ap, arguments); + ap = copyip_n(ap, arguments, MAXARGS); } else { ap = arguments; } - copyip (argv + 1, ap); + copyip_n (argv + 1, ap, MAXARGS); argp = arguments; while ((cp = *argp++)) { @@ -161,7 +161,7 @@ adios (NULL, "-%s unknown", cp); case HELPSW: - sprintf (buf, "%s [switches] file", invo_name); + snprintf (buf, BUFSIZ, "%s [switches] file", invo_name); print_help (buf, switches, 1); done (1); case VERSIONSW: @@ -272,13 +272,13 @@ } /* Check for public cache location */ - sprintf (buf, "%s-cache", invo_name); + snprintf (buf, BUFSIZ, "%s-cache", invo_name); if ((cache_public = context_find (buf)) && *cache_public != '/') cache_public = NULL; /* Check for private cache location */ - sprintf (buf, "%s-private-cache", invo_name); - if (!(cache_private = context_find (buf))) + snprintf (buf, BUFSIZ, "%s-private-cache", invo_name); + if ((cache_private = context_find (buf)) == NULL) cache_private = ".cache"; cache_private = getcpy (m_maildir (cache_private)); @@ -287,13 +287,13 @@ * will store temporary files there. Else we * store them in standard nmh directory. */ - sprintf (buf, "%s-storage", invo_name); + snprintf (buf, BUFSIZ,"%s-storage", invo_name); if ((cp = context_find (buf)) && *cp) tmp = concat (cp, "/", invo_name, NULL); else tmp = add (m_maildir (invo_name), NULL); - if (!context_find ("path")) + if (context_find ("path") == NULL) free (path ("./", TFOLDER)); /* Check if we have a file to process */ @@ -359,7 +359,7 @@ list_all_messages (cts, headsw, sizesw, verbosw, debugsw); /* Rename composition draft */ - sprintf (buffer, "%s.orig", m_backup (compfile)); + snprintf (buffer, BUFSIZ, "%s.orig", m_backup (compfile)); if (rename (compfile, buffer) == NOTOK) adios (compfile, "unable to rename %s to", buffer); --- nmh-0.27/uip/mhlsbr.c.security Mon May 25 02:32:59 1998 +++ nmh-0.27/uip/mhlsbr.c Sat Jul 18 14:04:48 1998 @@ -294,7 +294,7 @@ int width = 0, vecp = 0, i; char *cp, *folder = NULL; char *form = NULL, **ap, **argp; - char buf[80], *arguments[MAXARGS], *files[MAXARGS]; + char buf[BUFSIZ], *arguments[MAXARGS], *files[MAXARGS]; invo_name = r1bindex (argv[0], '/'); @@ -303,11 +303,11 @@ if ((cp = context_find (invo_name)) != NULL) { ap = brkstring (getcpy (cp), " ", "\n"); - ap = copyip (ap, arguments); + ap = copyip_n (ap, arguments, MAXARGS); } else { ap = arguments; } - copyip (argv + 1, ap); + copyip_n(argv + 1, ap, MAXARGS); argp = arguments; if ((cp = getenv ("FACEPROC"))) @@ -324,7 +324,7 @@ adios (NULL, "-%s unknown\n", cp); case HELPSW: - sprintf (buf, "%s [switches] [files ...]", invo_name); + snprintf (buf, BUFSIZ, "%s [switches] [files ...]", invo_name); print_help (buf, mhlswitches, 1); done (1); case VERSIONSW: @@ -460,10 +460,10 @@ if (digest) { printf ("%s", delim4); if (volume == 0) { - sprintf (buf, "End of %s Digest\n", digest); + snprintf (buf, BUFSIZ, "End of %s Digest\n", digest); } else - sprintf (buf, "End of %s Digest [Volume %d Issue %d]\n", digest, volume, issue); + snprintf (buf, BUFSIZ, "End of %s Digest [Volume %d Issue %d]\n", digest, volume, issue); i = strlen (buf); for (cp = buf + i; i > 1; i--) *cp++ = '*'; @@ -636,7 +636,7 @@ if (!*parptr) return 0; - strcpy (name, parse ()); + strncpy (name, parse (), NAMESZ); if (!strcasecmp (name, "component")) { if (ptos (name, &c1->c_text)) @@ -744,7 +744,7 @@ char *cp; static char result[NAMESZ]; - for (cp = result; *parptr; parptr++) { + for (cp = result; *parptr; parptr++ && cp-result < NAMESZ) { c = *parptr; if (isalnum (c) || c == '.' --- nmh-0.27/uip/mhn.c.security Fri Jun 19 03:24:28 1998 +++ nmh-0.27/uip/mhn.c Sat Jul 18 16:31:50 1998 @@ -218,7 +218,7 @@ int sizesw = 1, headsw = 1; int msgp = 0, msgnum, *icachesw; char *cp, *file = NULL, *folder = NULL; - char *maildir, buf[100], **ap, **argp; + char *maildir, buf[BUFSIZ], **ap, **argp; char *arguments[MAXARGS], *msgs[MAXARGS]; struct msgs *mp = NULL; CT ct, *ctp; @@ -228,13 +228,13 @@ setlocale(LC_ALL, ""); #endif invo_name = r1bindex (argv[0], '/'); - if ((cp = context_find (invo_name))) { + if ((cp = context_find (invo_name)) != NULL) { ap = brkstring (cp = getcpy (cp), " ", "\n"); - ap = copyip (ap, arguments); + ap = copyip_n(ap, arguments, MAXARGS); } else { ap = arguments; } - copyip (argv + 1, ap); + copyip_n(argv + 1, ap, MAXARGS); argp = arguments; while ((cp = *argp++)) { @@ -247,7 +247,7 @@ adios (NULL, "-%s unknown", cp); case HELPSW: - sprintf (buf, "%s [+folder] [msgs] [switches]", invo_name); + snprintf (buf, BUFSIZ, "%s [+folder] [msgs] [switches]", invo_name); print_help (buf, switches, 1); done (1); case VERSIONSW: @@ -468,13 +468,13 @@ } /* Check for public cache location */ - sprintf (buf, "%s-cache", invo_name); + snprintf (buf, BUFSIZ, "%s-cache", invo_name); if ((cache_public = context_find (buf)) && *cache_public != '/') cache_public = NULL; /* Check for private cache location */ - sprintf (buf, "%s-private-cache", invo_name); - if (!(cache_private = context_find (buf))) + snprintf (buf, BUFSIZ,"%s-private-cache", invo_name); + if ((cache_private = context_find (buf)) == NULL) cache_private = ".cache"; cache_private = getcpy (m_maildir (cache_private)); @@ -488,13 +488,13 @@ * then store temporary files there. Else we * store them in standard nmh directory. */ - sprintf (buf, "%s-storage", invo_name); + snprintf (buf, BUFSIZ, "%s-storage", invo_name); if ((cp = context_find (buf)) && *cp) tmp = concat (cp, "/", invo_name, NULL); else tmp = add (m_maildir (invo_name), NULL); - if (!context_find ("path")) + if (context_find ("path") == NULL) free (path ("./", TFOLDER)); /* --- nmh-0.27/uip/mhmail.c.security Wed Jan 14 21:10:29 1998 +++ nmh-0.27/uip/mhmail.c Sat Jul 18 14:04:48 1998 @@ -73,7 +73,7 @@ adios (NULL, "-%s unknown", cp); case HELPSW: - sprintf (buf, "%s [addrs ... [switches]]", invo_name); + snprintf (buf, BUFSIZ, "%s [addrs ... [switches]]", invo_name); print_help (buf, switches, 0); done (1); case VERSIONSW: --- nmh-0.27/uip/mhparam.c.security Thu Jan 22 17:53:01 1998 +++ nmh-0.27/uip/mhparam.c Sat Jul 18 16:32:07 1998 @@ -83,17 +83,17 @@ int i, compp = 0, missed = 0; int all = 0, debug = 0; int components = -1; - char *cp, buf[100], **ap, **argp; + char *cp, buf[BUFSIZ], **ap, **argp; char *arguments[MAXARGS], *comps[MAXARGS]; invo_name = r1bindex (argv[0], '/'); - if ((cp = context_find (invo_name))) { + if ((cp = context_find (invo_name)) != NULL) { ap = brkstring (cp = getcpy (cp), " ", "\n"); - ap = copyip (ap, arguments); + ap = copyip_n (ap, arguments, MAXARGS); } else { ap = arguments; } - copyip (argv + 1, ap); + copyip_n (argv + 1, ap, MAXARGS); argp = arguments; while ((cp = *argp++)) { @@ -106,7 +106,7 @@ adios (NULL, "-%s unknown", cp); case HELPSW: - sprintf (buf, "%s [profile-components] [switches]", invo_name); + snprintf (buf, BUFSIZ, "%s [profile-components] [switches]", invo_name); print_help (buf, switches, 1); done (1); case VERSIONSW: --- nmh-0.27/uip/mhpath.c.security Wed Jan 14 21:11:15 1998 +++ nmh-0.27/uip/mhpath.c Sat Jul 18 16:32:32 1998 @@ -28,7 +28,7 @@ int i, maxmsgs, msgp = 0; char *cp, *maildir, *folder = NULL; char **ap, **argp, **msgs; - char *arguments[MAXARGS], buf[100]; + char *arguments[MAXARGS], buf[BUFSIZ]; struct msgs *mp; #ifdef LOCALE @@ -37,11 +37,11 @@ invo_name = r1bindex (argv[0], '/'); if ((cp = context_find (invo_name)) != NULL) { ap = brkstring (cp = getcpy (cp), " ", "\n"); - ap = copyip (ap, arguments); + ap = copyip_n(ap, arguments, MAXARGS); } else { ap = arguments; } - copyip (argv + 1, ap); + copyip_n(argv + 1, ap, MAXARGS); argp = arguments; /* Allocate initial space to record message/sequence names */ @@ -59,7 +59,7 @@ adios (NULL, "-%s unknown", cp); case HELPSW: - sprintf (buf, "%s [+folder] [msgs] [switches]", invo_name); + snprintf (buf, BUFSIZ ,"%s [+folder] [msgs] [switches]", invo_name); print_help (buf, switches, 1); done (1); case VERSIONSW: @@ -82,7 +82,7 @@ } } - if (!context_find ("path")) + if (context_find ("path") == NULL) free (path ("./", TFOLDER)); if (!folder) --- nmh-0.27/uip/msgchk.c.security Sat May 16 17:29:34 1998 +++ nmh-0.27/uip/msgchk.c Sat Jul 18 16:33:01 1998 @@ -122,13 +122,13 @@ snoop++; #endif - if ((cp = context_find (invo_name))) { + if ((cp = context_find (invo_name)) != NULL) { ap = brkstring (cp = getcpy (cp), " ", "\n"); - ap = copyip (ap, arguments); + ap = copyip_n(ap, arguments, MAXARGS); } else { ap = arguments; } - copyip (argv + 1, ap); + copyip_n (argv + 1, ap, MAXARGS); argp = arguments; while ((cp = *argp++)) { @@ -173,7 +173,8 @@ case USERSW: if (!(cp = *argp++) || *cp == '-') adios (NULL, "missing argument to %s", argp[-2]); - vec[vecp++] = cp; + if (vecp < 50) + vec[vecp++] = cp; continue; case APOPSW: @@ -194,7 +195,8 @@ snoop++; continue; } - vec[vecp++] = cp; + if (vecp<50) + vec[vecp++] = cp; } #ifdef POP --- nmh-0.27/uip/msh.c.security Mon Jun 22 16:12:35 1998 +++ nmh-0.27/uip/msh.c Sat Jul 18 16:33:12 1998 @@ -236,7 +236,7 @@ { int id = 0, scansw = 0, vmh1 = 0, vmh2 = 0; char *cp, *file = NULL, *folder = NULL; - char **ap, **argp, buf[80]; + char **ap, **argp, buf[BUFSIZ]; char *arguments[MAXARGS]; #ifdef BPOP int pmsh1 = 0, pmsh2 = 0; @@ -247,13 +247,13 @@ #endif invo_name = r1bindex (argv[0], '/'); mts_init (invo_name); - if ((cp = context_find (invo_name))) { + if ((cp = context_find (invo_name)) != NULL) { ap = brkstring (cp = getcpy (cp), " ", "\n"); - ap = copyip (ap, arguments); + ap = copyip_n (ap, arguments, MAXARGS); } else { ap = arguments; } - copyip (argv + 1, ap); + copyip_n (argv + 1, ap, MAXARGS); argp = arguments; while ((cp = *argp++)) { @@ -266,7 +266,7 @@ adios (NULL, "-%s unknown", cp); case HELPSW: - sprintf (buf, "%s [switches] file", invo_name); + snprintf (buf, BUFSIZ, "%s [switches] file", invo_name); print_help (buf, switches, 1); done (1); case VERSIONSW: @@ -486,7 +486,7 @@ register struct Cmd *cmdp; static int once_only = ADVCMD; - sprintf (prompt, myprompt, invo_name); + snprintf (prompt, BUFSIZ, myprompt, invo_name); cmdp = &typein; for (;;) { @@ -537,7 +537,7 @@ case SORTCMD: if ((cp = context_find (cmd_name)) != NULL) { ap = brkstring (cp = getcpy (cp), " ", "\n"); - ap = copyip (ap, vec); + ap = copyip_n (ap, vec, MAXARGS); } else ap = vec; @@ -548,7 +548,7 @@ ap = vec; break; } - copyip (cmdp->args + 1, ap); + copyip_n (cmdp->args + 1, ap, MAXARGS); m_init (); @@ -726,7 +726,7 @@ #ifdef BPOP if (pmsh) { - strcpy (tmpfil, m_tmpfil (invo_name)); + strncpy (tmpfil, m_tmpfil (invo_name), BUFSIZ); if ((fp = fopen (tmpfil, "w+")) == NULL) padios (tmpfil, "unable to create"); unlink (tmpfil); @@ -1126,7 +1126,7 @@ { char buffer[BUFSIZ]; - sprintf (buffer, "%d-%d", low, hgh); + snprintf (buffer, BUFSIZ, "%d-%d", low, hgh); scanstring (buffer); } @@ -1138,7 +1138,7 @@ if ((cp = context_find (cmd_name = "scan")) != NULL) { ap = brkstring (cp = getcpy (cp), " ", "\n"); - ap = copyip (ap, vec); + ap = copyip_n (ap, vec, MAXARGS); } else ap = vec; @@ -1291,7 +1291,7 @@ write_ids (void) { int i = 0, seqnum, msgnum; - char buffer[80]; + char buffer[BUFSIZ]; if (pfd <= 1) return; @@ -1305,7 +1305,7 @@ break; } - sprintf (buffer, "%d %d\n", i, Msgs[mp->hghmsg].m_bboard_id); + snprintf (buffer, BUFSIZ, "%d %d\n", i, Msgs[mp->hghmsg].m_bboard_id); write (pfd, buffer, sizeof(buffer)); close (pfd); pfd = NOTOK; @@ -1381,8 +1381,8 @@ if (rename (tmpfil, mp->foldpath) == NOTOK) admonish (mp->foldpath, "unable to rename %s to", tmpfil); else { - strcpy (map1, map_name (tmpfil)); - strcpy (map2, map_name (mp->foldpath)); + strncpy (map1, map_name (tmpfil), BUFSIZ); + strncpy (map2, map_name (mp->foldpath), BUFSIZ); if (rename (map1, map2) == NOTOK) { admonish (map2, "unable to rename %s to", map1); @@ -1662,7 +1662,7 @@ return NOTOK; } - sprintf (path, "%s/%s", pp, cp ? cp : ""); + snprintf (path, BUFSIZ, "%s/%s", pp, cp ? cp : ""); strcpy (redirect, path); return OK; } --- nmh-0.27/uip/mshcmds.c.security Sun Feb 1 18:28:37 1998 +++ nmh-0.27/uip/mshcmds.c Sat Jul 18 14:04:48 1998 @@ -76,7 +76,7 @@ char *vec[MAXARGS]; vec[0] = r1bindex (pgm, '/'); - copyip (args, vec + 1); + copyip_n (args, vec + 1, MAXARGS); if (fmsh) { context_del (pfolder); @@ -164,7 +164,7 @@ fprintf (stderr, "-%s unknown\n", cp); return; case DIHELP: - sprintf (buf, "%s [msgs] [switches]", cmd_name); + snprintf (buf, BUFSIZ, "%s [msgs] [switches]", cmd_name); print_help (buf, distswit, 1); return; @@ -266,7 +266,7 @@ fprintf (stderr, "-%s unknown\n", cp); return; case EXHELP: - sprintf (buf, "%s [msgs] [switches]", cmd_name); + snprintf (buf, BUFSIZ, "%s [msgs] [switches]", cmd_name); print_help (buf, explswit, 1); return; @@ -495,7 +495,7 @@ fprintf (stderr, "-%s unknown\n", cp); return; case FIHELP: - sprintf (buf, "%s +folder... [msgs] [switches]", cmd_name); + snprintf (buf, BUFSIZ, "%s +folder... [msgs] [switches]", cmd_name); print_help (buf, fileswit, 1); return; @@ -657,7 +657,7 @@ fprintf (stderr, "-%s unknown\n", cp); return; case FLHELP: - sprintf (buf, "%s [+folder] [msg] [switches]", cmd_name); + snprintf (buf, BUFSIZ, "%s [+folder] [msg] [switches]", cmd_name); print_help (buf, foldswit, 1); return; @@ -720,7 +720,7 @@ } } else { - strcpy (buf, folder); + strncpy (buf, folder, BUFSIZ); if (expand (buf) == NOTOK) return; folder = buf; @@ -874,7 +874,7 @@ fprintf (stderr, "-%s unknown\n", cp); return; case FOHELP: - sprintf (buf, "%s [msgs] [switches]", cmd_name); + snprintf (buf, BUFSIZ, "%s [msgs] [switches]", cmd_name); print_help (buf, forwswit, 1); return; @@ -929,7 +929,7 @@ } /* foil search of .mh_profile */ - sprintf (buf, "%sXXXXXX", invo_name); + snprintf (buf, BUFSIZ, "%sXXXXXX", invo_name); vec[0] = (char *)mktemp (buf); vec[vecp++] = "-file"; vec[vecp] = NULL; @@ -941,7 +941,7 @@ seq_setprev (mp); if (filter) { - strcpy (buf, filter); + strncpy (buf, filter, BUFSIZ); if (expand (buf) == NOTOK) return; if (access (filter = getcpy (etcpath (buf)), R_OK) == NOTOK) { @@ -961,10 +961,10 @@ forw (char *proc, char *filter, int vecp, char **vec) { int i, child_id, msgnum, msgcnt; - char tmpfil[80], *args[MAXARGS]; + char tmpfil[BUFSIZ], *args[MAXARGS]; FILE *out; - strcpy (tmpfil, m_tmpfil (invo_name)); + strncpy (tmpfil, m_tmpfil (invo_name), sizeof(tmpfil)); interrupted = 0; if (filter) switch (child_id = fork ()) { @@ -1132,7 +1132,7 @@ fprintf (stderr, "-%s unknown\n", cp); return; case MHELP: - sprintf (buf, "%s [msgs] [switches]", cmd_name); + snprintf (buf, BUFSIZ, "%s [msgs] [switches]", cmd_name); print_help (buf, markswit, 1); return; @@ -1355,7 +1355,7 @@ fprintf (stderr, "-%s unknown\n", cp); return; case MHNHELPSW: - sprintf (buf, "%s [msgs] [switches]", cmd_name); + snprintf (buf, BUFSIZ, "%s [msgs] [switches]", cmd_name); print_help (buf, mhnswit, 1); return; @@ -1464,7 +1464,7 @@ fprintf (stderr, "-%s unknown\n", cp); return; case PAHELP: - sprintf (buf, "%s [msgs] [switches]", cmd_name); + snprintf (buf, BUFSIZ, "%s [msgs] [switches]", cmd_name); print_help (buf, packswit, 1); return; @@ -1641,7 +1641,7 @@ fprintf (stderr, "-%s unknown\n", cp); return; case PIHELP: - sprintf (buf, "%s [msgs] [switches]", cmd_name); + snprintf (buf, BUFSIZ, "%s [msgs] [switches]", cmd_name); print_help (buf, pickswit, 1); return; @@ -1827,7 +1827,7 @@ fprintf (stderr, "-%s unknown\n", cp); return; case REHELP: - sprintf (buf, "%s [msgs] [switches]", cmd_name); + snprintf (buf, BUFSIZ, "%s [msgs] [switches]", cmd_name); print_help (buf, replswit, 1); return; @@ -1917,7 +1917,7 @@ fprintf (stderr, "-%s unknown\n", cp); return; case RMHELP: - sprintf (buf, "%s [msgs] [switches]", cmd_name); + snprintf (buf, BUFSIZ, "%s [msgs] [switches]", cmd_name); print_help (buf, rmmswit, 1); return; } @@ -1966,7 +1966,7 @@ else for (msgnum = mp->lowsel; msgnum <= mp->hghsel; msgnum++) if (is_selected (mp, msgnum)) { - strcpy (buffer, m_backup (cp = m_name (msgnum))); + strncpy (buffer, m_backup (cp = m_name (msgnum)),sizeof(buffer)); if (rename (cp, buffer) == NOTOK) admonish (buffer, "unable to rename %s to", cp); } @@ -2058,7 +2058,7 @@ fprintf (stderr, "-%s unknown\n", cp); return; case SCHELP: - sprintf (buf, "%s [msgs] [switches]", cmd_name); + snprintf (buf, BUFSIZ, "%s [msgs] [switches]", cmd_name); print_help (buf, scanswit, 1); return; @@ -2304,7 +2304,7 @@ vec[vecp++] = --cp; continue; case SHHELP: - sprintf (buf, "%s %s[switches] [switches for showproc]", + snprintf (buf, BUFSIZ, "%s %s[switches] [switches for showproc]", cmd_name, mode ? NULL : "[msgs] "); print_help (buf, showswit, 1); return; @@ -2735,7 +2735,7 @@ fprintf (stderr, "-%s unknown\n", cp); return; case SOHELP: - sprintf (buf, "%s [msgs] [switches]", cmd_name); + snprintf (buf, BUFSIZ, "%s [msgs] [switches]", cmd_name); print_help (buf, sortswit, 1); return; @@ -2972,7 +2972,7 @@ process (int msgnum, char *proc, int vecp, char **vec) { int child_id, status; - char tmpfil[80]; + char tmpfil[BUFSIZ]; FILE *out; if (fmsh) { @@ -2984,14 +2984,14 @@ goto ready; } - strcpy (tmpfil, m_scratch ("", invo_name)); + strncpy (tmpfil, m_scratch ("", invo_name), BUFSIZ); if ((out = fopen (tmpfil, "w")) == NULL) { int olderr; extern int errno; - char newfil[80]; + char newfil[BUFSIZ]; olderr = errno; - strcpy (newfil, m_tmpfil (invo_name)); + strncpy (newfil, m_tmpfil (invo_name), BUFSIZ); if ((out = fopen (newfil, "w")) == NULL) { errno = olderr; advise (tmpfil, "unable to create temporary file"); --- nmh-0.27/uip/packf.c.security Wed Jan 14 21:14:15 1998 +++ nmh-0.27/uip/packf.c Sat Jul 18 16:33:27 1998 @@ -37,7 +37,7 @@ main (int argc, char **argv) { int msgp = 0, fd, msgnum; - char *cp, *maildir, *msgnam, *folder = NULL, buf[100]; + char *cp, *maildir, *msgnam, *folder = NULL, buf[BUFSIZ]; char **ap, **argp, *arguments[MAXARGS], *msgs[MAXARGS]; struct msgs *mp; struct stat st; @@ -46,13 +46,13 @@ setlocale(LC_ALL, ""); #endif invo_name = r1bindex (argv[0], '/'); - if ((cp = context_find (invo_name))) { + if ((cp = context_find (invo_name)) != NULL) { ap = brkstring (cp = getcpy (cp), " ", "\n"); - ap = copyip (ap, arguments); + ap = copyip_n(ap, arguments, MAXARGS); } else { ap = arguments; } - copyip (argv + 1, ap); + copyip_n(argv + 1, ap, MAXARGS); argp = arguments; while ((cp = *argp++)) { @@ -65,7 +65,7 @@ adios (NULL, "-%s unknown", cp); case HELPSW: - sprintf (buf, "%s [+folder] [msgs] [switches]", invo_name); + snprintf (buf, BUFSIZ, "%s [+folder] [msgs] [switches]", invo_name); print_help (buf, switches, 1); done (1); case VERSIONSW: @@ -94,7 +94,8 @@ adios (NULL, "only one folder at a time!"); folder = path (cp + 1, *cp == '+' ? TFOLDER : TSUBCWF); } else { - msgs[msgp++] = cp; + if(msgptw_hour, ts->tw_min, ts->tw_sec, dtwszone (ts)); if ((tw = dparsetime (buffer)) != NULL) return tw; - sprintf (buffer, "%02d %s %04d %s", + snprintf (buffer, BUFSIZ, "%02d %s %04d %s", ts->tw_mday, tw_moty[ts->tw_mon], ts->tw_year, ap); if ((tw = dparsetime (buffer)) != NULL) return tw; - sprintf (buffer, "%02d %s %04d %s %s", + snprintf (buffer, BUFSIZ, "%02d %s %04d %s %s", ts->tw_mday, tw_moty[ts->tw_mon], ts->tw_year, ap, dtwszone (ts)); if ((tw = dparsetime (buffer)) != NULL) --- nmh-0.27/uip/popi.c.security Sat May 16 17:29:08 1998 +++ nmh-0.27/uip/popi.c Sat Jul 18 16:33:50 1998 @@ -91,7 +91,7 @@ int autosw = 1, noisy = 1, rpop; char *cp, *maildir, *folder = NULL, *form = NULL; char *format = NULL, *host = NULL, *user = NULL; - char *pass = NULL, buf[100], **ap, **argp; + char *pass = NULL, buf[BUFSIZ], **ap, **argp; char *arguments[MAXARGS]; struct stat st; @@ -103,11 +103,11 @@ snoop++; if ((cp = context_find (invo_name)) != NULL) { ap = brkstring (cp = getcpy (cp), " ", "\n"); - ap = copyip (ap, arguments); + ap = copyip_n(ap, arguments, BUFSIZ); } else ap = arguments; - copyip (argv + 1, ap); + copyip_n(argv + 1, ap, BUFSIZ); argp = arguments; rpop = getuid() && !geteuid(); @@ -122,7 +122,7 @@ adios (NULL, "-%s unknown", cp); case HELPSW: - sprintf (buf, "%s [+folder] [switches]", invo_name); + snprintf (buf, BUFSIZ, "%s [+folder] [switches]", invo_name); print_help (buf, switches, 1); done (1); case VERSIONSW: @@ -209,7 +209,7 @@ setuid (getuid ()); ruserpass (host, &user, &pass); } - sprintf (mailname, "PO box for %s@%s", user, host); + snprintf (mailname, BUFSIZ, "PO box for %s@%s", user, host); if (pop_init (host, user, pass, snoop, rpop) == NOTOK) adios (NULL, "%s", response); @@ -219,7 +219,7 @@ /* get new format string */ nfs = new_fs (form, format, FORMAT); - if (!context_find ("path")) + if (context_find ("path") == NULL) free (path ("./", TFOLDER)); if (!folder) folder = getfolder (0); --- nmh-0.27/uip/popsbr.c.security Thu Jan 22 17:58:27 1998 +++ nmh-0.27/uip/popsbr.c Sat Jul 18 14:04:49 1998 @@ -83,24 +83,24 @@ if ((cp = strchr (response, '<')) == NULL || (lp = strchr (cp, '>')) == NULL) { sprintf (buffer, "APOP not available: %s", response); - strcpy (response, buffer); + strncpy (response, buffer, BUFSIZ); return NULL; } *++lp = NULL; - sprintf (buffer, "%s%s", cp, pass); + snprintf (buffer, BUFSIZ, "%s%s", cp, pass); MD5Init (&mdContext); MD5Update (&mdContext, (unsigned char *) buffer, (unsigned int) strlen (buffer)); MD5Final (digest, &mdContext); - sprintf (cp = buffer, "%s ", user); + snprintf (cp = buffer, BUFSIZ, "%s ", user); cp += strlen (cp); for (ep = (dp = digest) + sizeof digest / sizeof digest[0]; dp < ep; cp += 2) - sprintf (cp, "%02x", *dp++ & 0xff); + snprintf (cp, BUFSIZ-(cp-buffer), "%02x", *dp++ & 0xff); *cp = NULL; return buffer; @@ -136,7 +136,7 @@ # ifndef KPOP if ((fd1 = client (host, "tcp", POPSERVICE, rpop, response)) == NOTOK) # else /* KPOP */ - sprintf (buffer, "%s/%s", POPSERVICE, "kpop"); + snprintf (buffer, BUFSIZ, "%s/%s", POPSERVICE, "kpop"); if ((fd1 = client (host, "tcp", buffer, rpop, response)) == NOTOK) # endif #else /* NNTP */ @@ -148,9 +148,9 @@ char *s; if ((s = strerror(errno))) - sprintf (response, "unable to dup connection descriptor: %s", s); + snprintf (response, BUFSIZ, "unable to dup connection descriptor: %s", s); else - sprintf (response, "unable to dup connection descriptor: unknown error"); + snprintf (response, BUFSIZ, "unable to dup connection descriptor: unknown error"); close (fd1); return NOTOK; } @@ -223,7 +223,7 @@ #ifdef NNTP if (myname && *myname) - strcpy (xtnd_name, myname); /* interface from bbc to msh */ + strcpy (xtnd_name, myname, 512); /* interface from bbc to msh */ #endif /* NNTP */ if ((input = fdopen (in, "r")) == NULL @@ -404,7 +404,7 @@ if (result == NOTOK) return NOTOK; - strcpy (buffer, response); + strncpy (buffer, response, BUFSIZ); for (;;) switch (multiline ()) { @@ -412,7 +412,7 @@ return NOTOK; case DONE: - strcpy (response, buffer); + strncpy (response, buffer, BUFSIZ); return OK; case OK: @@ -478,12 +478,12 @@ va_start(ap, fmt); #ifndef NNTP /* needs to be fixed... va_end needs to be added */ - sprintf (buffer, "XTND %s", fmt); + snprintf (buffer, BUFSIZ, "XTND %s", fmt); result = traverse (action, buffer, a, b, c, d); va_end(ap); return result; #else /* NNTP */ - sprintf (buffer, fmt, a, b, c, d); + snprintf (buffer, BUFSIZ, fmt, a, b, c, d); ap = brkstring (buffer, " ", "\n"); /* a hack, i know... */ if (!strcasecmp(ap[0], "x-bboards")) { /* XTND "X-BBOARDS group */ @@ -502,11 +502,11 @@ if (!strcasecmp (ap[0], "bboards")) { if (ap[1]) { /* XTND "BBOARDS group" */ - sprintf (xtnd_name, "%s", ap[1]); /* save the name */ + snprintf (xtnd_name, 512, "%s", ap[1]); /* save the name */ if (command("GROUP %s", xtnd_name) == NOTOK) return NOTOK; - strcpy (buffer, response); /* action must ignore extra args */ + strncpy (buffer, response, BUFSIZ); /* action must ignore extra args */ ap = brkstring (response, " ", "\n");/* "211 nart first last g" */ xtnd_first = atoi (ap[2]); xtnd_last = atoi (ap[3]); @@ -568,7 +568,7 @@ { char *cp, buffer[BUFSIZ]; - vsprintf (buffer, fmt, ap); + vsnprintf (buffer, BUFSIZ, fmt, ap); if (poprint) if (pophack) { if ((cp = strchr (buffer, ' '))) @@ -625,10 +625,10 @@ if (buffer[TRMLEN] == 0) return DONE; else - strcpy (response, buffer + TRMLEN); + strncpy (response, buffer + TRMLEN, BUFSIZ); } else - strcpy (response, buffer); + strncpy (response, buffer, BUFSIZ); return OK; } --- nmh-0.27/uip/post.c.security Mon May 25 02:28:20 1998 +++ nmh-0.27/uip/post.c Sat Jul 18 14:04:49 1998 @@ -327,7 +327,7 @@ adios (NULL, "-%s unknown", cp); case HELPSW: - sprintf (buf, "%s [switches] file", invo_name); + snprintf (buf, BUFSIZ, "%s [switches] file", invo_name); print_help (buf, switches, 0); done (1); case VERSIONSW: @@ -533,7 +533,7 @@ } else { strcpy (tmpfil, m_scratch ("", m_maildir (invo_name))); if ((out = fopen (tmpfil, "w")) == NULL) { - strcpy (tmpfil, m_tmpfil (invo_name)); + strncpy (tmpfil, m_tmpfil (invo_name), BUFSIZ); if ((out = fopen (tmpfil, "w")) == NULL) adios (tmpfil, "unable to create"); } @@ -728,7 +728,7 @@ } nameoutput = linepos = 0; - sprintf (namep, "%s%s", !fill_in && (hdr->flags & HMNG) ? "Original-" : "", name); + snprintf (namep, BUFSIZ, "%s%s", !fill_in && (hdr->flags & HMNG) ? "Original-" : "", name); for (grp = 0, mp = tmpaddrs.m_next; mp; mp = np) if (mp->m_nohost) { /* also used to test (hdr->flags & HTRY) */ @@ -800,15 +800,15 @@ mygid = getgid (); time (&tclock); - strcpy (from, adrsprintf (NULL, NULL)); + strncpy (from, adrsprintf (NULL, NULL), BUFSIZ); - strcpy (myhost, LocalName ()); + strncpy (myhost, LocalName (), BUFSIZ); for (cp = myhost; *cp; cp++) *cp = uptolow (*cp); if ((cp = getfullname ()) && *cp) { - strcpy (sigbuf, cp); - sprintf (signature, "%s <%s>", sigbuf, adrsprintf (NULL, NULL)); + strncpy (sigbuf, cp, BUFSIZ); + snprintf (signature, BUFSIZ, "%s <%s>", sigbuf, adrsprintf (NULL, NULL)); if ((cp = getname (signature)) == NULL) adios (NULL, "getname () failed -- you lose extraordinarily big"); if ((mp = getm (cp, NULL, 0, AD_HOST, NULL)) == NULL) @@ -817,7 +817,7 @@ while (getname ("")) continue; } else { - strcpy (signature, adrsprintf (NULL, NULL)); + strncpy (signature, adrsprintf (NULL, NULL), BUFSIZ); } } @@ -923,7 +923,7 @@ mp->m_pers = getcpy (aka); if (format) { if (mp->m_gname && !fill_in) - sprintf (cp = buffer, "%s;", mp->m_gname); + snprintf (cp = buffer, BUFSIZ,"%s;", mp->m_gname); else cp = adrformat (mp); } @@ -1065,7 +1065,7 @@ int i; char buffer[BUFSIZ]; - sprintf (buffer, "%s\n", adrformat (mp)); + snprintf (buffer, BUFSIZ, "%s\n", adrformat (mp)); i = strlen (buffer); return (write (pfd, buffer, i) == i ? OK : NOTOK); @@ -1103,7 +1103,7 @@ char *vec[6]; FILE *out; - strcpy (bccfil, m_tmpfil ("bccs")); + strncpy (bccfil, m_tmpfil ("bccs"), BUFSIZ); if ((out = fopen (bccfil, "w")) == NULL) adios (bccfil, "unable to create"); chmod (bccfil, 0600); @@ -1423,19 +1423,19 @@ case LOCALHOST: mbox = lp->m_mbox; host = lp->m_host; - strcpy (addr, mbox); + strncpy (addr, mbox, BUFSIZ); break; case UUCPHOST: mbox = auxformat (lp, 0); host = NULL; - sprintf (addr, "%s!%s", lp->m_host, lp->m_mbox); + snprintf (addr, BUFSIZ, "%s!%s", lp->m_host, lp->m_mbox); break; default: /* let SendMail decide if the host is bad */ mbox = lp->m_mbox; host = lp->m_host; - sprintf (addr, "%s at %s", mbox, host); + snprintf (addr, BUFSIZ, "%s at %s", mbox, host); break; } @@ -1634,7 +1634,7 @@ case LOCALHOST: mbox = lp->m_mbox; host = LocalName (); - strcpy (addr, mbox); + strncpy (addr, mbox, BUFSIZ); break; case UUCPHOST: @@ -1647,7 +1647,7 @@ default: /* let MMDF decide if the host is bad */ mbox = lp->m_mbox; host = lp->m_host; - sprintf (addr, "%s at %s", mbox, host); + snprintf (addr, BUFSIZ, "%s at %s", mbox, host); break; } @@ -1881,7 +1881,7 @@ case OK: /* see if we need to add `+' */ - sprintf (fold, "%s%s", + snprintf (fold, BUFSIZ, "%s%s", *folder == '+' || *folder == '@' ? "" : "+", folder); /* now exec the fileproc */ @@ -1947,7 +1947,7 @@ char buffer[BUFSIZ]; va_list ap; - sprintf (buffer, "[%s]", rp_valstr (code)); + snprintf (buffer, BUFSIZ, "[%s]", rp_valstr (code)); va_start(ap, fmt); advertise (buffer, NULL, fmt, ap); --- nmh-0.27/uip/prompter.c.security Wed Jan 14 21:15:07 1998 +++ nmh-0.27/uip/prompter.c Sat Jul 18 16:34:02 1998 @@ -110,13 +110,13 @@ setlocale(LC_ALL, ""); #endif invo_name = r1bindex (argv[0], '/'); - if ((cp = context_find (invo_name))) { + if ((cp = context_find (invo_name)) != NULL) { ap = brkstring (cp = getcpy (cp), " ", "\n"); - ap = copyip (ap, arguments); + ap = copyip_n(ap, arguments, MAXARGS); } else { ap = arguments; } - copyip (argv + 1, ap); + copyip_n(argv + 1, ap, MAXARGS); argp = arguments; while ((cp = *argp++)) @@ -129,7 +129,7 @@ adios (NULL, "-%s unknown", cp); case HELPSW: - sprintf (buffer, "%s [switches] file", invo_name); + snprintf (buffer, BUFSIZ, "%s [switches] file", invo_name); print_help (buffer, switches, 1); done (1); case VERSIONSW: @@ -183,7 +183,7 @@ if ((in = fopen (drft, "r")) == NULL) adios (drft, "unable to open"); - strcpy (tmpfil, m_tmpfil (invo_name)); + strncpy (tmpfil, m_tmpfil (invo_name), BUFSIZ); if ((out = fopen (tmpfil, "w")) == NULL) adios (tmpfil, "unable to create"); chmod (tmpfil, 0600); --- nmh-0.27/uip/rcvdist.c.security Thu Jan 22 17:45:45 1998 +++ nmh-0.27/uip/rcvdist.c Sat Jul 18 16:34:09 1998 @@ -36,7 +36,7 @@ { pid_t child_id; int i, vecp = 1; - char *addrs = NULL, *cp, *form = NULL, buf[100]; + char *addrs = NULL, *cp, *form = NULL, buf[BUFSIZ]; char **ap, **argp, *arguments[MAXARGS], *vec[MAXARGS]; register FILE *fp; @@ -45,13 +45,13 @@ #endif invo_name = r1bindex (argv[0], '/'); mts_init (invo_name); - if ((cp = context_find (invo_name))) { + if ((cp = context_find (invo_name)) != NULL) { ap = brkstring (cp = getcpy (cp), " ", "\n"); - ap = copyip (ap, arguments); + ap = copyip_n (ap, arguments, MAXARGS); } else { ap = arguments; } - copyip (argv + 1, ap); + copyip_n(argv + 1, ap, MAXARGS); argp = arguments; while ((cp = *argp++)) { @@ -61,11 +61,12 @@ ambigsw (cp, switches); done (1); case UNKWNSW: - vec[vecp++] = --cp; + if(vecpf_name)); + strncpy (nmaildir, m_maildir (fp->f_name), BUFSIZ); if (stat (nmaildir, &st) == NOTOK) { if (errno != ENOENT) --- nmh-0.27/uip/repl.c.security Wed Jul 1 00:15:56 1998 +++ nmh-0.27/uip/repl.c Sat Jul 18 16:35:15 1998 @@ -136,7 +136,7 @@ int nedit = 0, nwhat = 0; char *cp, *cwd, *dp, *maildir, *file = NULL; char *folder = NULL, *msg = NULL, *dfolder = NULL; - char *dmsg = NULL, *ed = NULL, drft[BUFSIZ], buf[100]; + char *dmsg = NULL, *ed = NULL, drft[BUFSIZ], buf[BUFSIZ]; char **ap, **argp, *arguments[MAXARGS]; struct msgs *mp = NULL; struct stat st; @@ -150,13 +150,13 @@ setlocale(LC_ALL, ""); #endif invo_name = r1bindex (argv[0], '/'); - if ((cp = context_find (invo_name))) { + if ((cp = context_find (invo_name)) != NULL) { ap = brkstring (cp = getcpy (cp), " ", "\n"); - ap = copyip (ap, arguments); + ap = copyip_n(ap, arguments, MAXARGS); } else { ap = arguments; } - copyip (argv + 1, ap); + copyip_n(argv + 1, ap, MAXARGS); argp = arguments; while ((cp = *argp++)) { @@ -169,7 +169,7 @@ adios (NULL, "-%s unknown", cp); case HELPSW: - sprintf (buf, "%s: [+folder] [msg] [switches]", invo_name); + snprintf (buf, BUFSIZ, "%s: [+folder] [msg] [switches]", invo_name); print_help (buf, switches, 1); done (0); case VERSIONSW: @@ -326,7 +326,7 @@ cwd = getcpy (pwd ()); - if (!context_find ("path")) + if (context_find ("path") == NULL) free (path ("./", TFOLDER)); if (file && (msg || folder)) adios (NULL, "can't mix files and folders/msgs"); @@ -340,7 +340,7 @@ /* Check if a draft exists */ if (!buildsw && stat (drft, &st) != NOTOK) { #else - strcpy (drft, m_draft (dfolder, dmsg, NOUSE, &isdf)); + strncpy (drft, m_draft (dfolder, dmsg, NOUSE, &isdf), BUFSIZ); /* Check if a draft exists */ if (stat (drft, &st) != NOTOK) { --- nmh-0.27/uip/replsbr.c.security Wed Feb 25 17:36:41 1998 +++ nmh-0.27/uip/replsbr.c Sat Jul 18 14:04:49 1998 @@ -338,7 +338,7 @@ /* concatenate all the new addresses onto 'buf' */ for (isgroup = 0; cp = getname (str); ) { if ((mp = getm (cp, dfhost, dftype, AD_NAME, error)) == NULL) { - sprintf (baddr, "\t%s -- %s\n", cp, error); + snprintf (baddr, BUFSIZ, "\t%s -- %s\n", cp, error); badaddrs = add (baddr, badaddrs); continue; } @@ -390,7 +390,7 @@ return 0; if (querysw) { - sprintf (buffer, "Reply to %s? ", adrformat (np)); + snprintf (buffer, BUFSIZ, "Reply to %s? ", adrformat (np)); if (!gans (buffer, anoyes)) return 0; } --- nmh-0.27/uip/rmf.c.security Fri May 8 15:50:27 1998 +++ nmh-0.27/uip/rmf.c Sat Jul 18 16:35:35 1998 @@ -31,19 +31,19 @@ { int defolder = 0, interactive = -1; char *cp, *folder = NULL, newfolder[BUFSIZ]; - char buf[100], **ap, **argp, *arguments[MAXARGS]; + char buf[BUFSIZ], **ap, **argp, *arguments[MAXARGS]; #ifdef LOCALE setlocale(LC_ALL, ""); #endif invo_name = r1bindex (argv[0], '/'); - if ((cp = context_find (invo_name))) { + if ((cp = context_find (invo_name)) != NULL) { ap = brkstring (cp = getcpy (cp), " ", "\n"); - ap = copyip (ap, arguments); + ap = copyip_n (ap, arguments, MAXARGS); } else { ap = arguments; } - copyip (argv + 1, ap); + copyip_n(argv + 1, ap, MAXARGS); argp = arguments; while ((cp = *argp++)) { @@ -56,7 +56,7 @@ adios (NULL, "-%s unknown", cp); case HELPSW: - sprintf (buf, "%s [+folder] [switches]", invo_name); + snprintf (buf, BUFSIZ, "%s [+folder] [switches]", invo_name); print_help (buf, switches, 1); done (1); case VERSIONSW: @@ -81,7 +81,7 @@ } } - if (!context_find ("path")) + if (context_find ("path") == NULL) free (path ("./", TFOLDER)); if (!folder) { folder = getfolder (1); @@ -99,9 +99,9 @@ if (cp > newfolder) *cp = '\0'; else - strcpy (newfolder, getfolder(0)); + strncpy (newfolder, getfolder(0), BUFSIZ); } else { - strcpy (newfolder, getfolder(0)); + strncpy (newfolder, getfolder(0), BUFSIZ); } if (interactive) { @@ -134,7 +134,7 @@ break; /* fall otherwise */ case NOTOK: - sprintf (cur, "atr-%s-%s", current, m_mailpath (folder)); + snprintf (cur, BUFSIZ, "atr-%s-%s", current, m_mailpath (folder)); if (!context_del (cur)) { printf ("[+%s de-referenced]\n", folder); return OK; --- nmh-0.27/uip/rmm.c.security Mon Jun 22 16:16:45 1998 +++ nmh-0.27/uip/rmm.c Sat Jul 18 16:35:53 1998 @@ -21,7 +21,7 @@ { int msgp = 0, msgnum; char *cp, *maildir, *folder = NULL; - char buf[100], **ap, **argp; + char buf[BUFSIZ], **ap, **argp; char *arguments[MAXARGS], *msgs[MAXARGS]; struct msgs *mp; @@ -29,13 +29,13 @@ setlocale(LC_ALL, ""); #endif invo_name = r1bindex (argv[0], '/'); - if ((cp = context_find (invo_name))) { + if ((cp = context_find (invo_name)) != NULL) { ap = brkstring (cp = getcpy (cp), " ", "\n"); - ap = copyip (ap, arguments); + ap = copyip_n (ap, arguments, MAXARGS); } else { ap = arguments; } - copyip (argv + 1, ap); + copyip_n (argv + 1, ap, MAXARGS); argp = arguments; while ((cp = *argp++)) { @@ -48,7 +48,7 @@ adios (NULL, "-%s unknown\n", cp); case HELPSW: - sprintf (buf, "%s [+folder] [msgs] [switches]", invo_name); + snprintf (buf, BUFSIZ, "%s [+folder] [msgs] [switches]", invo_name); print_help (buf, switches, 1); done (1); case VERSIONSW: @@ -62,11 +62,12 @@ else folder = path (cp + 1, *cp == '+' ? TFOLDER : TSUBCWF); } else { - msgs[msgp++] = cp; + if(msgp=MAXARGS-2) + break; vec[vecp++] = "-alias"; vec[vecp++] = *ap; } @@ -282,7 +295,8 @@ goto go_to_it; } #endif /* WHATNOW */ - msgs[msgp++] = getcpy (m_draft (NULL, NULL, 1, &isdf)); + if(msgp", (int) getpid(), + snprintf (msgid, BUFSIZ, "<%d.%ld@%s>", (int) getpid(), (long) clock, LocalName()); fseek (in, start, SEEK_SET); @@ -242,7 +242,7 @@ char tmpdrf[BUFSIZ]; FILE *out; - strcpy (tmpdrf, m_scratch (drft, invo_name)); + strncpy (tmpdrf, m_scratch (drft, invo_name), BUFSIZ); if ((out = fopen (tmpdrf, "w")) == NULL) adios (tmpdrf, "unable to open for writing"); chmod (tmpdrf, 0600); @@ -348,7 +348,7 @@ if (annotext) { if ((fd2 = tmp_fd ()) != NOTOK) { vec[vecp++] = "-idanno"; - sprintf (buf, "%d", fd2); + snprintf (buf, BUFSIZ, "%d", fd2); vec[vecp++] = buf; } else { admonish (NULL, "unable to create file for annotation list"); @@ -466,7 +466,7 @@ dup2 (out, fileno (stdin)); close (out); /* create subject for error notification */ - sprintf (buf, "send failed on %s", + snprintf (buf, BUFSIZ, "send failed on %s", forwsw ? "enclosed draft" : file); execlp (mailproc, r1bindex (mailproc, '/'), getusername (), @@ -487,7 +487,7 @@ int fd; char tmpfil[BUFSIZ]; - strcpy (tmpfil, m_tmpfil (invo_name)); + strncpy (tmpfil, m_tmpfil (invo_name), BUFSIZ); if ((fd = open (tmpfil, O_RDWR | O_CREAT | O_TRUNC, 0600)) == NOTOK) return NOTOK; if (debugsw) --- nmh-0.27/uip/show.c.security Sun Feb 1 18:16:41 1998 +++ nmh-0.27/uip/show.c Sat Jul 18 16:36:57 1998 @@ -61,7 +61,7 @@ int nshow = 0, checkmime = 1, mime; int vecp = 1, procp = 1, isdf = 0, mode = SHOW, msgnum; char *cp, *maildir, *file = NULL, *folder = NULL, *proc; - char buf[100], **ap, **argp, *arguments[MAXARGS]; + char buf[BUFSIZ], **ap, **argp, *arguments[MAXARGS]; char *msgs[MAXARGS], *vec[MAXARGS]; struct msgs *mp; @@ -76,13 +76,13 @@ mode = PREV; } - if ((cp = context_find (invo_name))) { + if ((cp = context_find (invo_name)) != NULL) { ap = brkstring (cp = getcpy (cp), " ", "\n"); - ap = copyip (ap, arguments); + ap = copyip_n (ap, arguments, MAXARGS); } else { ap = arguments; } - copyip (argv + 1, ap); + copyip_n (argv + 1, ap, MAXARGS); argp = arguments; while ((cp = *argp++)) { @@ -93,11 +93,12 @@ done (1); case UNKWNSW: case NPROGSW: - vec[vecp++] = --cp; + if(vecplowsel; msgnum <= mp->hghsel; msgnum++) if (is_selected(mp, msgnum)) - vec[vecp++] = getcpy (m_name (msgnum)); + if(vecphghsel); /* update current message */ seq_save (mp); /* synchronize sequences */ @@ -308,11 +317,15 @@ */ if (strcmp (r1bindex (proc, '/'), "mhn") == 0) { if (draftsw || file) { - vec[vecp] = vec[vecp - 1]; - vec[vecp - 1] = "-file"; - vecp++; + if(vecppw_dir, mmdflfil[0] ? mmdflfil : pw->pw_name); mbox = mailbox; @@ -539,9 +539,9 @@ continue; /* else fall */ case '+': if (*string == '+') - strcpy(tmpbuf, string); + snprintf(tmpbuf, BUFSIZ, "%s", string); else - sprintf(tmpbuf, "+%s", string); + snprintf(tmpbuf, BUFSIZ, "+%s", string); vec[2] = "rcvstore"; vec[3] = tmpbuf; vec[4] = NULL; @@ -1068,7 +1068,7 @@ } i = strlen ("From "); - strcpy (buffer, envelope + i); + snprintf(buffer, BUFSIZ, "%s", envelope + i); if ((cp = strchr(buffer, '\n'))) { *cp = 0; cp -= 24; @@ -1101,7 +1101,7 @@ char buffer[BUFSIZ]; FILE *qfp, *ffp; - strcpy (tmpfil, m_tmpfil (invo_name)); + snprintf(tmpfil, BUFSIZ, "%s", m_tmpfil (invo_name)); /* open temporary file to put message in */ if ((fd1 = open (tmpfil, O_RDWR | O_CREAT | O_TRUNC, 0600)) == -1) @@ -1186,10 +1186,10 @@ if (hp) { /* return path for UUCP style addressing */ ep = strchr(++hp, '\n'); - sprintf (buffer, "Return-Path: %.*s!%.*s\n", ep - hp, hp, cp - fp, fp); + snprintf (buffer, BUFSIZ, "Return-Path: %.*s!%.*s\n", ep - hp, hp, cp - fp, fp); } else { /* return path for standard domain addressing */ - sprintf (buffer, "Return-Path: %.*s\n", cp - fp, fp); + snprintf (buffer, BUFSIZ, "Return-Path: %.*s\n", cp - fp, fp); } /* Add Return-Path header to message */ @@ -1243,7 +1243,7 @@ return NULL; /* copy string into temp buffer */ - strcpy (buffer, cp); + strncpy (buffer, cp, sizeof(buffer)); bp = buffer; /* skip over leading whitespace */ --- nmh-0.27/uip/sortm.c.security Thu Jan 22 17:47:15 1998 +++ nmh-0.27/uip/sortm.c Sat Jul 18 16:37:13 1998 @@ -66,7 +66,7 @@ { int msgp = 0, i, msgnum; char *cp, *maildir, *datesw = NULL; - char *folder = NULL, buf[100], **ap, **argp; + char *folder = NULL, buf[BUFSIZ], **ap, **argp; char *arguments[MAXARGS], *msgs[MAXARGS]; struct msgs *mp; struct smsg **dlist; @@ -75,13 +75,13 @@ setlocale(LC_ALL, ""); #endif invo_name = r1bindex (argv[0], '/'); - if ((cp = context_find (invo_name))) { + if ((cp = context_find (invo_name)) != NULL) { ap = brkstring (cp = getcpy (cp), " ", "\n"); - ap = copyip (ap, arguments); + ap = copyip_n (ap, arguments, MAXARGS); } else { ap = arguments; } - copyip (argv + 1, ap); + copyip_n (argv + 1, ap, MAXARGS); argp = arguments; while ((cp = *argp++)) { @@ -94,7 +94,7 @@ adios (NULL, "-%s unknown", cp); case HELPSW: - sprintf(buf, "%s [+folder] [msgs] [switches]", invo_name); + snprintf(buf, BUFSIZ, "%s [+folder] [msgs] [switches]", invo_name); print_help (buf, switches, 1); done (1); case VERSIONSW: @@ -154,11 +154,12 @@ else folder = path (cp + 1, *cp == '+' ? TFOLDER : TSUBCWF); } else { - msgs[msgp++] = cp; + if(msgphghmsg + 1)); + strncpy (tmpfil, m_name (mp->hghmsg + 1), BUFSIZ); for (i = 0; i < nmsgs; i++) { if (! (sp = mlist[i])) @@ -529,7 +530,7 @@ */ old = smsgs[j].s_msg; new = smsgs[i].s_msg; - strcpy (f1, m_name (old)); + strncpy (f1, m_name (old), BUFSIZ); if (verbose) printf ("renaming message chain from %d to %d\n", old, new); --- nmh-0.27/uip/spop.c.security Sun Nov 30 04:41:10 1997 +++ nmh-0.27/uip/spop.c Sat Jul 18 14:04:49 1998 @@ -333,7 +333,7 @@ } va_start(ap, fmt); - vsprintf (buffer, fmt, ap); + vsnprintf (buffer, BUFSIZ-1 /* for the \n */, fmt, ap); va_end(ap); bp = buffer; @@ -375,14 +375,14 @@ if (rp_isbad (sm_waend ())) goto sm_err; - sprintf (buffer, + snprintf (buffer, BUFSIZ, "Date: %s\nFrom: %s\nTo: %s\nSubject: BBoards Failure\n\n", dtimenow (0), bb_from, bb_from); if (rp_isbad (sm_wtxt (buffer, strlen (buffer)))) goto sm_err; for (i = 0; bb[i]; i++) { - sprintf (buffer, "BBoard %s\n", bb[i]->bb_name); + snprintf (buffer, BUFSIZ, "BBoard %s\n", bb[i]->bb_name); if (rp_isbad (sm_wtxt (buffer, strlen (buffer)))) goto sm_err; } @@ -512,8 +512,8 @@ bb_uid = pw->pw_uid; bb_gid = pw->pw_gid; #ifndef SPOP - strcpy (bb_from, adrsprintf (pw->pw_name, LocalName ())); - strcpy (bb_home, pw->pw_dir); + strcpy (bb_from, adrsprintf (pw->pw_name, LocalName ()), BUFSIZ); + strcpy (bb_home, pw->pw_dir, BUFSIZ); #endif not SPOP if (*vec == NULL) --- nmh-0.27/uip/spost.c.security Sat May 16 17:38:10 1998 +++ nmh-0.27/uip/spost.c Sat Jul 18 14:22:59 1998 @@ -210,8 +210,8 @@ invo_name = r1bindex (argv[0], '/'); mts_init (invo_name); if ((cp = context_find (invo_name)) != NULL) { - argp = copyip (brkstring (cp, " ", "\n"), arguments); - copyip (argv+1, argp); + argp = copyip_n (brkstring (cp, " ", "\n"), arguments, MAXARGS); + copyip_n (argv+1, argp, MAXARGS); argp = arguments; } @@ -391,7 +391,7 @@ fclose (in); if (backflg && !whomflg) { - strcpy (buf, m_backup (msg)); + strncpy (buf, m_backup (msg), BUFSIZ); if (rename (msg, buf) == NOTOK) advise (buf, "unable to rename %s to", msg); } @@ -528,14 +528,14 @@ char *cp; char sigbuf[BUFSIZ]; - strcpy( from, getusername() ); + strncpy( from, getusername(), BUFSIZ); if ((cp = getfullname ()) && *cp) { - strcpy (sigbuf, cp); - sprintf (signature, "%s <%s>", sigbuf, from); + strncpy (sigbuf, cp, BUFSIZ); + snprintf (signature, BUFSIZ, "%s <%s>", sigbuf, from); } else - sprintf (signature, "%s", from); + snprintf (signature, BUFSIZ, "%s", from); } --- nmh-0.27/uip/vmh.c.security Mon Jun 22 16:20:28 1998 +++ nmh-0.27/uip/vmh.c Sat Jul 18 16:37:34 1998 @@ -224,13 +224,13 @@ setlocale(LC_ALL, ""); #endif invo_name = r1bindex (argv[0], '/'); - if ((cp = context_find (invo_name))) { + if ((cp = context_find (invo_name)) != NULL) { ap = brkstring (cp = getcpy (cp), " ", "\n"); - ap = copyip (ap, arguments); + ap = copyip_n (ap, arguments, MAXARGS); } else { ap = arguments; } - copyip (argv + 1, ap); + copyip_n (argv + 1, ap, MAXARGS); argp = arguments; while ((cp = *argp++)) @@ -244,7 +244,7 @@ continue; case HELPSW: - sprintf (buffer, "%s [switches for vmhproc]", invo_name); + snprintf (buffer, BUFSIZ, "%s [switches for vmhproc]", invo_name); print_help (buffer, switches, 1); done (1); case VERSIONSW: @@ -265,7 +265,8 @@ continue; } else - vec[vecp++] = cp; + if(vecp< MAXARGS-1) + vec[vecp++] = cp; if (TTYinit (nprog) == NOTOK || WINinit (nprog) == NOTOK) { vec[vecp] = NULL; @@ -340,10 +341,10 @@ close (pfd1[1]); vec[vecp++] = "-vmhread"; - sprintf (buf1, "%d", pfd1[0]); + snprintf (buf1, BUFSIZ, "%d", pfd1[0]); vec[vecp++] = buf1; vec[vecp++] = "-vmhwrite"; - sprintf (buf2, "%d", pfd0[1]); + snprintf (buf2, BUFSIZ, "%d", pfd0[1]); vec[vecp++] = buf2; vec[vecp] = NULL; @@ -373,14 +374,16 @@ struct record rcs; register struct record *rc = &rcs; register WINDOW **w; + int len; initrc (rc); bp = buffer; - sprintf (bp, "%d %d", RC_VRSN, numwins); + len = BUFSIZ; + len -= snprintf (bp, len, "%d %d", RC_VRSN, numwins); bp += strlen (bp); for (w = windows; *w; w++) { - sprintf (bp, " %d", (*w)->_maxy); + len -= snprintf (bp, len, " %d", (*w)->_maxy); bp += strlen (bp); } @@ -796,7 +799,8 @@ } if (c >= ' ' && c < '\177') - waddch (w, *bp++ = c); + if(bp-buffer < BUFSIZ-1) + waddch (w, *bp++ = c); break; } @@ -1471,7 +1475,7 @@ iov++; } - vsprintf (buffer, fmt, ap); + vsnprintf (buffer, BUFSIZ, fmt, ap); iov->iov_len = strlen (iov->iov_base = buffer); iov++; if (what) { @@ -1484,7 +1488,7 @@ iov++; } if (!(iov->iov_base = strerror (eindex))) { - sprintf (err, "Error %d", eindex); + snprintf (err, BUFSIZ, "Error %d", eindex); iov->iov_base = err; } iov->iov_len = strlen (iov->iov_base); --- nmh-0.27/uip/vmhsbr.c.security Wed Dec 17 03:27:26 1997 +++ nmh-0.27/uip/vmhsbr.c Sat Jul 18 14:04:49 1998 @@ -41,7 +41,7 @@ PEERwfd = wfd; if ((cp = getenv ("MHVDEBUG")) && *cp) { - sprintf (buffer, "%s.out", invo_name); + snprintf (buffer, BUFSIZ, "%s.out", invo_name); if ((fp = fopen (buffer, "w"))) { fseek (fp, 0L, SEEK_END); fprintf (fp, "%d: rcinit (%d, %d)\n", (int) getpid(), rfd, wfd); @@ -179,18 +179,18 @@ int eindex = errno; register char *bp, *s; char buffer[BUFSIZ * 2]; - - vsprintf (buffer, fmt, ap); + int len=BUFSIZ*2; + len-=vsnprintf (buffer, len, fmt, ap); bp = buffer + strlen (buffer); if (what) { if (*what) { - sprintf (bp, " %s: ", what); + len-=snprintf (bp, len, " %s: ", what); bp += strlen (bp); } if ((s = strerror (eindex))) - strcpy (bp, s); + len-=snprintf(bp, len, "%s",s); else - sprintf (bp, "unknown error %d", eindex); + len-=snprintf (bp, len, "unknown error %d", eindex); bp += strlen (bp); } @@ -205,7 +205,7 @@ static char buffer[BUFSIZ * 2]; va_start(ap, fmt); - vsprintf (buffer, fmt, ap); + vsnprintf (buffer, BUFSIZ*2, fmt, ap); va_end(ap); rc->rc_len = strlen (rc->rc_data = getcpy (buffer)); --- nmh-0.27/uip/vmhtest.c.security Wed Jan 14 21:19:58 1998 +++ nmh-0.27/uip/vmhtest.c Sat Jul 18 14:04:49 1998 @@ -58,7 +58,7 @@ adios (NULL, "-%s unknown", cp); case HELPSW: - sprintf (buffer, "%s [switches]", invo_name); + snprintf (buffer, BUFSIZ, "%s [switches]", invo_name); print_help (buffer, switches, 0); done (1); case VERSIONSW: @@ -241,7 +241,7 @@ initrc (rc); - sprintf (buffer, "%d", selwin ()); + snprintf (buffer, BUFSIZ, "%d", selwin ()); switch (str2rc (RC_WIN, buffer, rc)) { case RC_ACK: break; --- nmh-0.27/uip/whatnowproc.c.security Thu Jul 2 18:21:58 1998 +++ nmh-0.27/uip/whatnowproc.c Sat Jul 18 16:40:19 1998 @@ -24,7 +24,8 @@ int found, k, msgnum, vecp; register char *bp; char buffer[BUFSIZ], *vec[MAXARGS]; - + int len; + vecp = 0; vec[vecp++] = r1bindex (whatnowproc, '/'); vec[vecp] = NULL; @@ -38,7 +39,7 @@ if (mp == NULL || *altmsg == '/' || cwd == NULL) m_putenv ("mhaltmsg", altmsg); else { - sprintf (buffer, "%s/%s", mp->foldpath, altmsg); + snprintf (buffer, BUFSIZ, "%s/%s", mp->foldpath, altmsg); m_putenv ("mhaltmsg", buffer); } } else { @@ -46,7 +47,7 @@ } if ((bp = getenv ("mhaltmsg")))/* XXX */ m_putenv ("editalt", bp); - sprintf (buffer, "%d", dist); + snprintf (buffer, BUFSIZ, "%d", dist); m_putenv ("mhdist", buffer); if (nedit) { unputenv ("mheditor"); @@ -54,7 +55,7 @@ m_putenv ("mheditor", ed ? ed : (ed = context_find ("editor")) ? ed : defaulteditor); } - sprintf (buffer, "%d", use); + snprintf (buffer, BUFSIZ, "%d", use); m_putenv ("mhuse", buffer); unputenv ("mhmessages"); @@ -63,14 +64,15 @@ if (text && mp && !is_readonly(mp)) { found = 0; bp = buffer; + len = BUFSIZ; for (msgnum = mp->lowmsg; msgnum <= mp->hghmsg; msgnum++) { if (is_selected(mp, msgnum)) { - sprintf (bp, "%s%s", found ? " " : "", m_name (msgnum)); + len-=snprintf (bp, len, "%s%s", found ? " " : "", m_name (msgnum)); bp += strlen (bp); for (k = msgnum + 1; k <= mp->hghmsg && is_selected(mp, k); k++) continue; if (--k > msgnum) { - sprintf (bp, "-%s", m_name (k)); + len-=snprintf (bp, len, "-%s", m_name (k)); bp += strlen (bp); } msgnum = k + 1; @@ -80,7 +82,7 @@ if (found) { m_putenv ("mhmessages", buffer); m_putenv ("mhannotate", text); - sprintf (buffer, "%d", inplace); + snprintf (buffer, BUFSIZ, "%d", inplace); m_putenv ("mhinplace", buffer); } } --- nmh-0.27/uip/whatnowsbr.c.security Fri Jul 3 17:19:21 1998 +++ nmh-0.27/uip/whatnowsbr.c Sat Jul 18 16:38:14 1998 @@ -82,18 +82,18 @@ int isdf = 0, nedit = 0, use = 0; char *cp, *dfolder = NULL, *dmsg = NULL; char *ed = NULL, *drft = NULL, *msgnam = NULL; - char buf[100], prompt[BUFSIZ]; + char buf[BUFSIZ], prompt[BUFSIZ]; char **ap, **argp, *arguments[MAXARGS]; struct stat st; invo_name = r1bindex (argv[0], '/'); - if ((cp = context_find (invo_name))) { + if ((cp = context_find (invo_name)) != NULL) { ap = brkstring (cp = getcpy (cp), " ", "\n"); - ap = copyip (ap, arguments); + ap = copyip_n (ap, arguments, MAXARGS); } else { ap = arguments; } - copyip (argv + 1, ap); + copyip_n (argv + 1, ap, MAXARGS); argp = arguments; while ((cp = *argp++)) { @@ -106,7 +106,7 @@ adios (NULL, "-%s unknown", cp); case HELPSW: - sprintf (buf, "%s [switches] [file]", invo_name); + snprintf (buf, BUFSIZ, "%s [switches] [file]", invo_name); print_help (buf, whatnowswitches, 1); done (1); case VERSIONSW: @@ -170,7 +170,7 @@ if (!nedit && editfile (&ed, NULL, drft, use, NULL, msgnam, NULL, 1) < 0) done (1); - sprintf (prompt, myprompt, invo_name); + snprintf (prompt, BUFSIZ, myprompt, invo_name); for (;;) { if (!(argp = getans (prompt, aleqs))) { unlink (LINK); @@ -294,13 +294,13 @@ if (altmsg) { if (mp == NULL || *altmsg == '/' || cwd == NULL) - strcpy (altpath, altmsg); + snprintf(altpath, BUFSIZ, "%s", altmsg); else - sprintf (altpath, "%s/%s", mp->foldpath, altmsg); + snprintf (altpath, BUFSIZ, "%s/%s", mp->foldpath, altmsg); if (cwd == NULL) - strcpy (linkpath, LINK); + snprintf(linkpath, BUFSIZ, "%s", LINK); else - sprintf (linkpath, "%s/%s", cwd, LINK); + snprintf (linkpath, BUFSIZ, "%s/%s", cwd, LINK); } if (altmsg) { @@ -702,7 +702,7 @@ sendit (char *sp, char **arg, char *file, int pushed) { int vecp = 1; - char *cp, buf[100], **ap, **argp; + char *cp, buf[BUFSIZ], **ap, **argp; char *arguments[MAXARGS], *vec[MAXARGS]; struct stat st; @@ -714,15 +714,15 @@ #endif if (arg) - copyip (arg, vec); - if ((cp = context_find (sp))) { + copyip_n (arg, vec, MAXARGS); + if ((cp = context_find (sp)) != NULL) { ap = brkstring (cp = getcpy (cp), " ", "\n"); - ap = copyip (ap, arguments); + ap = copyip_n (ap, arguments, MAXARGS); } else { ap = arguments; } if (arg) - copyip (vec, ap); + copyip_n (vec, ap, MAXARGS); argp = arguments; debugsw = 0; @@ -748,7 +748,7 @@ return; case SHELPSW: - sprintf (buf, "%s [switches]", sp); + snprintf (buf, BUFSIZ, "%s [switches]", sp); print_help (buf, sendswitches, 1); return; case SVERSIONSW: @@ -840,7 +840,7 @@ } /* allow Aliasfile: profile entry */ - if ((cp = context_find ("Aliasfile"))) { + if ((cp = context_find ("Aliasfile")) != NULL) { char *dp = NULL; for (ap = brkstring(dp = getcpy(cp), " ", "\n"); ap && *ap; ap++) { @@ -854,7 +854,7 @@ m_putenv ("SIGNATURE", cp); #ifdef UCI else { - sprintf (buf, "%s/.signature", mypath); + snprintf (buf, BUFSIZ, "%s/.signature", mypath); if ((fp = fopen (buf, "r")) != NULL && fgets (buf, sizeof(buf), fp) != NULL) { fclose (fp); @@ -922,7 +922,7 @@ vec[vecp++] = r1bindex (whomproc, '/'); vec[vecp++] = file; if (arg) - while (*arg) + while (*arg && vecp MAXARGS-3) + break; vec[vecp++] = "-alias"; vec[vecp++] = *ap; } @@ -143,7 +145,8 @@ if (dfolder || (cp = getenv ("mhdraft")) == NULL || *cp == '\0') #endif /* WHATNOW */ cp = getcpy (m_draft (dfolder, dmsg, 1, &isdf)); - msg = vec[vecp++] = cp; + if(vecpw_height); + len-=snprintf (bp, len, " %d", (*w)->w_height); bp += strlen (bp); } @@ -1325,7 +1327,7 @@ iov++; } - vsprintf (buffer, fmt, ap); + vsnprintf (buffer, BUFSIZ, fmt, ap); iov->iov_len = strlen (iov->iov_base = buffer); iov++; if (what) { @@ -1338,7 +1340,7 @@ iov++; } if (!(iov->iov_base = strerror (eindex))) { - sprintf (err, "unknown error %d", eindex); + snprintf (err, BUFSIZ, "unknown error %d", eindex); iov->iov_base = err; } iov->iov_len = strlen (iov->iov_base); @@ -1368,7 +1370,7 @@ char buffer[BUFSIZ]; for (i = 0, cp = NULL; i < n; i++, iov++) { - sprintf (buffer, "%*.*s", iov->iov_len, iov->iov_len, + snprintf (buffer, BUFSIZ, "%*.*s", iov->iov_len, iov->iov_len, iov->iov_base); cp = add (buffer, cp); } --- nmh-0.27/uip/mhmisc.c.security Sat Jul 18 14:42:48 1998 +++ nmh-0.27/uip/mhmisc.c Sat Jul 18 14:50:24 1998 @@ -135,16 +135,17 @@ char *bp; char buffer[BUFSIZ]; CI ci; + int len=BUFSIZ-2; bp = buffer; if (userrs && invo_name && *invo_name) { - sprintf (bp, "%s: ", invo_name); + len-=snprintf (bp, len, "%s: ", invo_name); bp += strlen (bp); } va_start (arglist, fmt); - vsprintf (bp, fmt, arglist); + len-=vsnprintf (bp, len, fmt, arglist); bp += strlen (bp); ci = &ct->c_ctinfo; @@ -152,28 +153,28 @@ char *s; if (*what) { - sprintf (bp, " %s: ", what); + len-=snprintf (bp, len, " %s: ", what); bp += strlen (bp); } if ((s = strerror (errno))) - sprintf (bp, "%s", s); + len-=snprintf (bp, len, "%s", s); else - sprintf (bp, "Error %d", errno); + len-=snprintf (bp, len, "Error %d", errno); bp += strlen (bp); } i = strlen (invo_name) + 2; - sprintf (bp, "\n%*.*s(content %s/%s", i, i, "", ci->ci_type, ci->ci_subtype); + len-=snprintf (bp, len, "\n%*.*s(content %s/%s", i, i, "", ci->ci_type, ci->ci_subtype); bp += strlen (bp); if (ct->c_file) { - sprintf (bp, " in message %s", ct->c_file); + len-=snprintf (bp, len, " in message %s", ct->c_file); bp += strlen (bp); if (ct->c_partno) { - sprintf (bp, ", part %s", ct->c_partno); + len-=snprintf (bp, len, ", part %s", ct->c_partno); bp += strlen (bp); } } - sprintf (bp, ")"); + len-=snprintf (bp, len, ")"); bp += strlen (bp); if (userrs) { --- nmh-0.27/uip/mhlistsbr.c.security Sat Jul 18 14:44:13 1998 +++ nmh-0.27/uip/mhlistsbr.c Sat Jul 18 14:45:47 1998 @@ -162,7 +162,7 @@ printf (toplevel > 0 ? LSTFMT2a : toplevel < 0 ? "part " : " ", atoi (r1bindex (empty (ct->c_file), '/'))); - sprintf (buffer, "%s/%s", empty (ci->ci_type), empty (ci->ci_subtype)); + snprintf (buffer, BUFSIZ, "%s/%s", empty (ci->ci_type), empty (ci->ci_subtype)); printf (LSTFMT2b, empty (ct->c_partno), buffer); if (ct->c_cesizefnx && realsize) @@ -213,7 +213,7 @@ dp = trimcpy (cp = add (ci->ci_comment, NULL)); free (cp); - sprintf (buffer, "(%s)", dp); + snprintf (buffer, BUFSIZ, "(%s)", dp); free (dp); printf (LSTFMT2d2, buffer); } --- nmh-0.27/uip/mhbuildsbr.c.security Sat Jul 18 14:51:08 1998 +++ nmh-0.27/uip/mhbuildsbr.c Sat Jul 18 15:44:33 1998 @@ -1026,7 +1026,7 @@ bp = buffer; cp++; - for (i = 0;;) { + for (i = 0;bp-bufferc_partno) { - sprintf (partnam, "%s.", ct->c_partno); - pp = partnam + strlen (partnam); + l-=snprintf (partnam, l, "%s.", ct->c_partno); + pp += strlen (partnam); } - else - pp = partnam; for (part = m->mp_parts, partnum = 1; part; part = part->mp_next, partnum++) { p = part->mp_part; - sprintf (pp, "%d", partnum); + l-=snprintf (pp, l, "%d", partnum); p->c_partno = add (partnam, NULL); if (p->c_ctinitfnx && (*p->c_ctinitfnx) (p) == NOTOK) { @@ -2160,7 +2160,7 @@ putc (';', ce->ce_fp); len++; - sprintf (buffer, "%s=\"%s\"", *ap, *ep); + snprintf (buffer, BUFSIZ, "%s=\"%s\"", *ap, *ep); if (len + 1 + (cc = strlen (buffer)) >= CPERLIN) { fputs ("\n\t", ce->ce_fp); @@ -2385,11 +2385,12 @@ CE ce; static char *username = NULL; static char *password = NULL; + int len=BUFSIZ; e = ct->c_ctexbody; ce = ct->c_cefile; - sprintf (buffer, "%s-access-ftp", invo_name); + snprintf (buffer, BUFSIZ, "%s-access-ftp", invo_name); if ((ftp = context_find (buffer)) && !*ftp) ftp = NULL; @@ -2423,26 +2424,26 @@ } bp = buffer; - sprintf (bp, "Retrieve %s", e->eb_name); + len-=snprintf (bp, len, "Retrieve %s", e->eb_name); bp += strlen (bp); if (e->eb_partno) { - sprintf (bp, " (content %s)", e->eb_partno); + len-=snprintf (bp, len, " (content %s)", e->eb_partno); bp += strlen (bp); } - sprintf (bp, "\n using %sFTP from site %s", + len-=snprintf (bp, len, "\n using %sFTP from site %s", e->eb_flags ? "anonymous " : "", e->eb_site); bp += strlen (bp); if (e->eb_size > 0) { - sprintf (bp, " (%lu octets)", e->eb_size); + len-=snprintf (bp, len, " (%lu octets)", e->eb_size); bp += strlen (bp); } - sprintf (bp, "? "); + len-=snprintf (bp, len, "? "); if (!getanswer (buffer)) return NOTOK; if (e->eb_flags) { user = "anonymous"; - sprintf (pass = buffer, "%s@%s", getusername (), LocalName ()); + snprintf (pass = buffer, BUFSIZ, "%s@%s", getusername (), LocalName ()); } else { ruserpass (e->eb_site, &username, &password); user = username; @@ -2587,6 +2588,7 @@ char *bp, buffer[BUFSIZ], *vec[7]; struct exbody *e = ct->c_ctexbody; CE ce = ct->c_cefile; + int len=BUFSIZ; switch (openExternal (e->eb_parent, e->eb_content, ce, file, &fd)) { case NOTOK: @@ -2612,13 +2614,13 @@ } bp = buffer; - sprintf (bp, "Retrieve content"); + len-=snprintf (bp, len, "Retrieve content"); bp += strlen (bp); if (e->eb_partno) { - sprintf (bp, " %s", e->eb_partno); + len-=snprintf (bp, len, " %s", e->eb_partno); bp += strlen (bp); } - sprintf (bp, " by asking %s\n\n%s\n? ", + len-=snprintf (bp, len, " by asking %s\n\n%s\n? ", e->eb_server, e->eb_subject ? e->eb_subject : e->eb_body); if (!getanswer (buffer)) @@ -2733,6 +2735,7 @@ if (status == OK && policy == CACHE_ASK) { char *bp, query[BUFSIZ]; + int ql=BUFSIZ; if (xpid) { if (xpid < 0) @@ -2742,23 +2745,24 @@ } bp = query; - if (writing) - sprintf (bp, "Make cached, publically-accessible copy"); - else { + if (writing) { + ql-=snprintf (bp, ql, "Make cached, publically-accessible copy"); + bp += strlen (bp); + } else { struct stat st; - sprintf (bp, "Use cached copy"); + ql-=snprintf (bp, ql, "Use cached copy"); bp += strlen (bp); if (ct->c_partno) { - sprintf (bp, " of content %s", ct->c_partno); + ql-=snprintf (bp, ql, " of content %s", ct->c_partno); bp += strlen (bp); } stat (buffer, &st); - sprintf (bp, " (size %lu octets)", + ql-=snprintf (bp, ql, " (size %lu octets)", (unsigned long) st.st_size); + bp += strlen (bp); } - bp += strlen (bp); - sprintf (bp, "\n in file %s? ", buffer); + ql-=snprintf (bp, ql, "\n in file %s? ", buffer); if (!getanswer (query)) status = NOTOK; } @@ -2791,7 +2795,7 @@ if (debugsw) fprintf (stderr, "find_cache_aux %s usemap=%d\n", directory, usemap); - sprintf (mapfile, "%s/cache.map", directory); + snprintf (mapfile, BUFSIZ, "%s/cache.map", directory); if (find_cache_aux2 (mapfile, id, mapname) == OK) goto done_map; @@ -2800,7 +2804,7 @@ return NOTOK; use_raw: - sprintf (buffer, "%s/%s", directory, id); + snprintf (buffer, BUFSIZ, "%s/%s", directory, id); return OK; } @@ -2826,7 +2830,7 @@ partno = 0; } - sprintf (mapname, "%08x%04x%02x", + snprintf (mapname, BUFSIZ, "%08x%04x%02x", (unsigned int) (clock & 0xffffffff), (unsigned int) (pid & 0xffff), (unsigned int) (partno++ & 0xff)); @@ -2852,9 +2856,9 @@ done_map: if (*mapname == '/') - strcpy (buffer, mapname); + strncpy (buffer, mapname, BUFSIZ); else - sprintf (buffer, "%s/%s", directory, mapname); + snprintf (buffer, BUFSIZ, "%s/%s", directory, mapname); if (debugsw) fprintf (stderr, "use %s\n", buffer); @@ -2996,7 +3000,7 @@ adios (ct->c_file, "unable to open for writing"); if (buf[0] == '#' && buf[1] == '<') { - strcpy (content, buf + 2); + strncpy (content, buf + 2, BUFSIZ); inlineD = 1; goto rock_and_roll; } else { @@ -3005,7 +3009,7 @@ strcpy (content, "text/plain"); /* the directive is implicit */ headers = 0; - strcpy (buffer, buf[0] != '#' ? buf : buf + 1); + strncpy (buffer, buf[0] != '#' ? buf : buf + 1, BUFSIZ); for (;;) { int i; @@ -3157,7 +3161,7 @@ ci->ci_type, ci->ci_subtype); p = ct; - sprintf (buffer, "message/external-body; %s", ci->ci_magic); + snprintf (buffer, BUFSIZ, "message/external-body; %s", ci->ci_magic); free (ci->ci_magic); ci->ci_magic = NULL; @@ -3214,9 +3218,9 @@ * No [file] argument, so check profile for * method to compose content. */ - sprintf (buffer, "%s-compose-%s/%s", invo_name, ci->ci_type, ci->ci_subtype); + snprintf (buffer, BUFSIZ, "%s-compose-%s/%s", invo_name, ci->ci_type, ci->ci_subtype); if ((cp = context_find (buffer)) == NULL || *cp == '\0') { - sprintf (buffer, "%s-compose-%s", invo_name, ci->ci_type); + snprintf (buffer, BUFSIZ, "%s-compose-%s", invo_name, ci->ci_type); if ((cp = context_find (buffer)) == NULL || *cp == '\0') { content_error (NULL, ct, "don't know how to compose content"); done (1); @@ -3240,7 +3244,7 @@ if (ci->ci_magic) { ap = brkstring (ci->ci_magic, " ", "\n"); - ap = copyip (ap, arguments); + ap = copyip_n (ap, arguments, MAXARGS); } else { arguments[0] = "cur"; arguments[1] = NULL; @@ -3298,7 +3302,7 @@ p->c_type = CT_MESSAGE; p->c_subtype = MESSAGE_RFC822; - sprintf (buffer, "%s/%d", mp->foldpath, msgnum); + snprintf (buffer, BUFSIZ, "%s/%d", mp->foldpath, msgnum); p->c_file = add (buffer, NULL); if (listsw && stat (p->c_file, &st) != NOTOK) p->c_end = (long) st.st_size; @@ -3317,7 +3321,7 @@ ct->c_subtype = MESSAGE_RFC822; msgnum = mp->lowsel; - sprintf (buffer, "%s/%d", mp->foldpath, msgnum); + snprintf (buffer, BUFSIZ, "%s/%d", mp->foldpath, msgnum); ct->c_file = add (buffer, NULL); if (listsw && stat (ct->c_file, &st) != NOTOK) ct->c_end = (long) st.st_size; @@ -3357,7 +3361,7 @@ } free_ctinfo (ct); - sprintf (buffer, "multipart/%s", cp); + snprintf (buffer, BUFSIZ, "multipart/%s", cp); if (get_ctinfo (buffer, ct, 0) == NOTOK) done (1); ct->c_type = CT_MULTIPART; @@ -3408,12 +3412,12 @@ if (clock == 0) { time (&clock); - sprintf (msgid, "<%d.%ld.%%d@%s>\n", + snprintf (msgid, BUFSIZ, "<%d.%ld.%%d@%s>\n", (int) getpid(), (long) clock, LocalName()); partno = 0; msgfmt = getcpy(msgid); } - sprintf (msgid, msgfmt, top ? 0 : ++partno); + snprintf (msgid, BUFSIZ, msgfmt, top ? 0 : ++partno); ct->c_id = getcpy (msgid); } @@ -3474,18 +3478,18 @@ char partnam[BUFSIZ]; struct multipart *m = (struct multipart *) ct->c_ctparams; struct part *part; + int len = BUFSIZ; + pp = partnam; if (ct->c_partno) { - sprintf (partnam, "%s.", ct->c_partno); - pp = partnam + strlen (partnam); - } else { - pp = partnam; + len-=snprintf (partnam, len, "%s.", ct->c_partno); + pp += strlen (partnam); } for (part = m->mp_parts, partnum = 1; part; part = part->mp_next, partnum++) { CT p = part->mp_part; - sprintf (pp, "%d", partnum); + len-=snprintf (pp, len, "%d", partnum); p->c_partno = add (partnam, NULL); if (compose_content (p) == NOTOK) return NOTOK; @@ -3542,6 +3546,7 @@ char *bp, **ap; char *vec[4]; FILE *out; + int len; if (!(cp = ci->ci_magic)) adios (NULL, "internal error(5)"); @@ -3555,6 +3560,7 @@ /* * Parse composition string */ + len = BUFSIZ; for (bp = buffer; *cp; cp++) { if (*cp == '%') { switch (*++cp) { @@ -3565,7 +3571,7 @@ char *s = ""; for (ap = ci->ci_attrs, ep = ci->ci_values; *ap; ap++, ep++) { - sprintf (bp, "%s%s=\"%s\"", s, *ap, *ep); + len-=snprintf (bp, len, "%s%s=\"%s\"", s, *ap, *ep); bp += strlen (bp); s = " "; } @@ -3582,12 +3588,12 @@ * insert temporary filename where * content should be written */ - sprintf (bp, "%s", ct->c_file); + snprintf (bp, len, "%s", ct->c_file); break; case 's': /* insert content subtype */ - strcpy (bp, ci->ci_subtype); + strncpy (bp, ci->ci_subtype, len); break; case '%': @@ -3595,15 +3601,24 @@ goto raw; default: - *bp++ = *--cp; - *bp = '\0'; + if (len>1) { + *bp++ = *--cp; + *bp = '\0'; + len--; + } continue; } - bp += strlen (bp); + if (*bp) { + len -= strlen (bp); + bp += strlen (bp); + } } else { raw: - *bp++ = *cp; - *bp = '\0'; + if (len>1) { + *bp++ = *cp; + *bp = '\0'; + len--; + } } } @@ -3910,7 +3925,7 @@ ap = ci->ci_attrs; ep = ci->ci_values; - sprintf (buffer, "boundary=%s%d", prefix, level++); + snprintf (buffer, BUFSIZ, "boundary=%s%d", prefix, level++); cp = strchr(*ap++ = add (buffer, NULL), '='); *ap = NULL; *cp++ = '\0'; @@ -3948,7 +3963,7 @@ putc (';', out); len++; - sprintf (buffer, "%s=\"%s\"", *ap, *ep); + snprintf (buffer, BUFSIZ, "%s=\"%s\"", *ap, *ep); if (len + 1 + (cc = strlen (buffer)) >= CPERLIN) { fputs ("\n\t", out); --- nmh-0.27/uip/viamail.c.security Sat Jul 18 15:25:45 1998 +++ nmh-0.27/uip/viamail.c Sat Jul 18 16:37:27 1998 @@ -73,7 +73,7 @@ int delay = 0; char *f1 = NULL, *f2 = NULL, *f3 = NULL; char *f4 = NULL, *f5 = NULL, *f7 = NULL; - char *cp, buf[100], **ap; + char *cp, buf[BUFSIZ], **ap; char **argp, *arguments[MAXARGS]; #ifdef LOCALE @@ -87,13 +87,13 @@ if (context_foil (NULL) == -1) done (1); - if ((cp = context_find (invo_name))) { + if ((cp = context_find (invo_name)) != NULL) { ap = brkstring (cp = getcpy (cp), " ", "\n"); - ap = copyip (ap, arguments); + ap = copyip_n (ap, arguments, MAXARGS); } else { ap = arguments; } - copyip (argv + 1, ap); + copyip_n (argv + 1, ap, MAXARGS); argp = arguments; while ((cp = *argp++)) { @@ -106,7 +106,7 @@ adios (NULL, "-%s unknown", cp); case HELPSW: - sprintf (buf, "%s [switches]", invo_name); + snprintf (buf, BUFSIZ, "%s [switches]", invo_name); print_help (buf, switches, 1); done (1); case VERSIONSW: --- nmh-0.27/uip/mhshowsbr.c.security Sat Jul 18 15:51:18 1998 +++ nmh-0.27/uip/mhshowsbr.c Sat Jul 18 16:03:47 1998 @@ -293,12 +293,12 @@ CI ci = &ct->c_ctinfo; /* Check for mhn-show-type/subtype */ - sprintf (buffer, "%s-show-%s/%s", invo_name, ci->ci_type, ci->ci_subtype); + snprintf (buffer, BUFSIZ, "%s-show-%s/%s", invo_name, ci->ci_type, ci->ci_subtype); if ((cp = context_find (buffer)) && *cp != '\0') return show_content_aux (ct, serial, alternate, cp, NULL); /* Check for mhn-show-type */ - sprintf (buffer, "%s-show-%s", invo_name, ci->ci_type); + snprintf (buffer, BUFSIZ, "%s-show-%s", invo_name, ci->ci_type); if ((cp = context_find (buffer)) && *cp != '\0') return show_content_aux (ct, serial, alternate, cp, NULL); @@ -325,6 +325,7 @@ char *bp, *file; char buffer[BUFSIZ]; CI ci = &ct->c_ctinfo; + int len; if (!ct->c_ceopenfnx) { if (!alternate) @@ -345,11 +346,12 @@ xtty = 0; if (cracked) { - strcpy (buffer, cp); + strncpy (buffer, cp, BUFSIZ); goto got_command; } buffer[0] = '\0'; + len = BUFSIZ; for (bp = buffer; *cp; cp++) { if (*cp == '%') { switch (*++cp) { @@ -360,7 +362,7 @@ char *s = ""; for (ap = ci->ci_attrs, ep = ci->ci_values; *ap; ap++, ep++) { - sprintf (bp, "%s%s=\"%s\"", s, *ap, *ep); + len-=snprintf (bp, len, "%s%s=\"%s\"", s, *ap, *ep); bp += strlen (bp); s = " "; } @@ -372,7 +374,7 @@ if (ct->c_descr) { char *s; - strcpy (bp, s = trimcpy (ct->c_descr)); + strncpy (bp, s = trimcpy (ct->c_descr), len); free (s); } break; @@ -390,7 +392,7 @@ case 'f': /* insert filename containing content */ - sprintf (bp, "%s", file); + snprintf (bp, len, "%s", file); break; case 'p': @@ -405,7 +407,7 @@ case 's': /* insert subtype of content */ - strcpy (bp, ci->ci_subtype); + strncpy (bp, ci->ci_subtype, len); break; case '%': @@ -413,15 +415,24 @@ goto raw; default: - *bp++ = *--cp; - *bp = '\0'; + if (len>1) { + *bp++ = *--cp; + *bp = '\0'; + len--; + } continue; } - bp += strlen (bp); + if (*bp) { + len -= strlen (bp); + bp += strlen (bp); + } } else { raw: - *bp++ = *cp; - *bp = '\0'; + if (len>1) { + *bp++ = *cp; + *bp = '\0'; + len--; + } } } @@ -430,7 +441,7 @@ char term[BUFSIZ]; strcpy (term, buffer); - sprintf (buffer, ct->c_termproc, term); + snprintf (buffer, BUFSIZ, ct->c_termproc, term); } got_command: @@ -556,12 +567,12 @@ CI ci = &ct->c_ctinfo; /* Check for mhn-show-type/subtype */ - sprintf (buffer, "%s-show-%s/%s", invo_name, ci->ci_type, ci->ci_subtype); + snprintf (buffer, BUFSIZ, "%s-show-%s/%s", invo_name, ci->ci_type, ci->ci_subtype); if ((cp = context_find (buffer)) && *cp != '\0') return show_content_aux (ct, serial, alternate, cp, NULL); /* Check for mhn-show-type */ - sprintf (buffer, "%s-show-%s", invo_name, ci->ci_type); + snprintf (buffer, BUFSIZ, "%s-show-%s", invo_name, ci->ci_type); if ((cp = context_find (buffer)) && *cp != '\0') return show_content_aux (ct, serial, alternate, cp, NULL); @@ -570,7 +581,7 @@ * if it is not a text part of a multipart/alternative */ if (!alternate || ct->c_subtype == TEXT_PLAIN) { - sprintf (buffer, "%%p%s '%%F'", progsw ? progsw : + snprintf (buffer, BUFSIZ, "%%p%s '%%F'", progsw ? progsw : moreproc && *moreproc ? moreproc : "more"); cp = (ct->c_showproc = add (buffer, NULL)); return show_content_aux (ct, serial, alternate, cp, NULL); @@ -591,12 +602,12 @@ CI ci = &ct->c_ctinfo; /* Check for mhn-show-type/subtype */ - sprintf (buffer, "%s-show-%s/%s", invo_name, ci->ci_type, ci->ci_subtype); + snprintf (buffer, BUFSIZ, "%s-show-%s/%s", invo_name, ci->ci_type, ci->ci_subtype); if ((cp = context_find (buffer)) && *cp != '\0') return show_multi_aux (ct, serial, alternate, cp); /* Check for mhn-show-type */ - sprintf (buffer, "%s-show-%s", invo_name, ci->ci_type); + snprintf (buffer, BUFSIZ, "%s-show-%s", invo_name, ci->ci_type); if ((cp = context_find (buffer)) && *cp != '\0') return show_multi_aux (ct, serial, alternate, cp); @@ -769,6 +780,7 @@ struct part *part; CI ci = &ct->c_ctinfo; CT p; + int len; for (part = m->mp_parts; part; part = part->mp_next) { p = part->mp_part; @@ -798,6 +810,7 @@ xtty = 0; buffer[0] = '\0'; + len = BUFSIZ; for (bp = buffer; *cp; cp++) { if (*cp == '%') { switch (*++cp) { @@ -808,7 +821,7 @@ char *s = ""; for (ap = ci->ci_attrs, ep = ci->ci_values; *ap; ap++, ep++) { - sprintf (bp, "%s%s=\"%s\"", s, *ap, *ep); + len-=snprintf (bp, len, "%s%s=\"%s\"", s, *ap, *ep); bp += strlen (bp); s = " "; } @@ -820,7 +833,7 @@ if (ct->c_descr) { char *s; - strcpy (bp, s = trimcpy (ct->c_descr)); + strncpy (bp, s = trimcpy (ct->c_descr), len); free (s); } break; @@ -843,7 +856,7 @@ for (part = m->mp_parts; part; part = part->mp_next) { p = part->mp_part; - sprintf (bp, "%s'%s'", s, p->c_storage); + len-=snprintf (bp, len, "%s'%s'", s, p->c_storage); bp += strlen (bp); s = " "; } @@ -862,7 +875,7 @@ case 's': /* insert subtype of content */ - strcpy (bp, ci->ci_subtype); + strncpy (bp, ci->ci_subtype, len); break; case '%': @@ -870,15 +883,24 @@ goto raw; default: - *bp++ = *--cp; - *bp = '\0'; + if (len>1) { + *bp++ = *--cp; + *bp = '\0'; + len--; + } continue; } - bp += strlen (bp); + if (*bp) { + len -= strlen(bp); + bp += strlen (bp); + } } else { raw: - *bp++ = *cp; - *bp = '\0'; + if (len>1) { + *bp++ = *cp; + *bp = '\0'; + len--; + } } } @@ -887,7 +909,7 @@ char term[BUFSIZ]; strcpy (term, buffer); - sprintf (buffer, ct->c_termproc, term); + snprintf (buffer, BUFSIZ, ct->c_termproc, term); } return show_content_aux2 (ct, serial, alternate, NULL, buffer, @@ -906,12 +928,12 @@ CI ci = &ct->c_ctinfo; /* Check for mhn-show-type/subtype */ - sprintf (buffer, "%s-show-%s/%s", invo_name, ci->ci_type, ci->ci_subtype); + snprintf (buffer, BUFSIZ, "%s-show-%s/%s", invo_name, ci->ci_type, ci->ci_subtype); if ((cp = context_find (buffer)) && *cp != '\0') return show_content_aux (ct, serial, alternate, cp, NULL); /* Check for mhn-show-type */ - sprintf (buffer, "%s-show-%s", invo_name, ci->ci_type); + snprintf (buffer, BUFSIZ, "%s-show-%s", invo_name, ci->ci_type); if ((cp = context_find (buffer)) && *cp != '\0') return show_content_aux (ct, serial, alternate, cp, NULL); --- nmh-0.27/uip/mhstoresbr.c.security Sat Jul 18 16:05:41 1998 +++ nmh-0.27/uip/mhstoresbr.c Sat Jul 18 16:13:42 1998 @@ -72,7 +72,7 @@ static int output_content_file (CT, int); static int check_folder (char *); static int output_content_folder (char *, char *); -static int parse_format_string (CT, char *, char *, char *); +static int parse_format_string (CT, char *, char *, int, char *); static void get_storeproc (CT); static int copy_some_headers (FILE *, CT); @@ -95,7 +95,7 @@ if (autosw) { dir = getcpy (cwd); } else { - sprintf (buffer, "%s-storage", invo_name); + snprintf (buffer, BUFSIZ, "%s-storage", invo_name); if ((cp = context_find (buffer)) && *cp) dir = getcpy (cp); else @@ -530,9 +530,9 @@ if ((cp = ct->c_storeproc) == NULL || *cp == '\0') { CI ci = &ct->c_ctinfo; - sprintf (buffer, "%s-store-%s/%s", invo_name, ci->ci_type, ci->ci_subtype); + snprintf (buffer, BUFSIZ, "%s-store-%s/%s", invo_name, ci->ci_type, ci->ci_subtype); if ((cp = context_find (buffer)) == NULL || *cp == '\0') { - sprintf (buffer, "%s-store-%s", invo_name, ci->ci_type); + snprintf (buffer, BUFSIZ, "%s-store-%s", invo_name, ci->ci_type); if ((cp = context_find (buffer)) == NULL || *cp == '\0') { cp = ct->c_type == CT_MESSAGE ? "+" : "%m%P.%s"; } @@ -572,7 +572,7 @@ /* * Parse and expand the storage formatting string. */ - parse_format_string (ct, cp, buffer, dir); + parse_format_string (ct, cp, buffer, BUFSIZ, dir); /* * If formatting begins with '|' or '!', then pass @@ -928,7 +928,7 @@ */ static int -parse_format_string (CT ct, char *cp, char *buffer, char *dir) +parse_format_string (CT ct, char *cp, char *buffer, int len, char *dir) { char *bp; CI ci = &ct->c_ctinfo; @@ -938,7 +938,7 @@ * return (send content to standard output). */ if (!cp[1]) { - sprintf (buffer, "-"); + snprintf(buffer, len, "="); return 0; } @@ -951,7 +951,7 @@ * appropriate directory. */ if (*cp != '/' && *cp != '|' && *cp != '!') { - sprintf (buffer, "%s/", dir[1] ? dir : ""); + len-=snprintf (buffer, len, "%s/", dir[1] ? dir : ""); bp += strlen (bp); } @@ -966,8 +966,11 @@ * This is only valid for '|' commands. */ if (buffer[0] != '|' && buffer[0] != '!') { - *bp++ = *--cp; - *bp = '\0'; + if (len>1) { + *bp++ = *--cp; + *bp = '\0'; + len--; + } continue; } else { char **ap, **ep; @@ -975,7 +978,7 @@ for (ap = ci->ci_attrs, ep = ci->ci_values; *ap; ap++, ep++) { - sprintf (bp, "%s%s=\"%s\"", s, *ap, *ep); + len-=snprintf (bp, len, "%s%s=\"%s\"", s, *ap, *ep); bp += strlen (bp); s = " "; } @@ -984,29 +987,29 @@ case 'm': /* insert message number */ - sprintf (bp, "%s", r1bindex (ct->c_file, '/')); + snprintf (bp, len, "%s", r1bindex (ct->c_file, '/')); break; case 'P': /* insert part number with leading dot */ if (ct->c_partno) - sprintf (bp, ".%s", ct->c_partno); + snprintf (bp, len, ".%s", ct->c_partno); break; case 'p': /* insert part number withouth leading dot */ if (ct->c_partno) - strcpy (bp, ct->c_partno); + strncpy (bp, ct->c_partno, len); break; case 't': /* insert content type */ - strcpy (bp, ci->ci_type); + strncpy (bp, ci->ci_type, len); break; case 's': /* insert content subtype */ - strcpy (bp, ci->ci_subtype); + strncpy (bp, ci->ci_subtype, len); break; case '%': @@ -1014,16 +1017,25 @@ goto raw; default: - *bp++ = *--cp; - *bp = '\0'; + if (len > 1) { + *bp++ = *--cp; + *bp = '\0'; + len--; + } continue; } - bp += strlen (bp); + if (*bp) { + len -= strlen (bp); + bp += strlen (bp); + } } else { raw: - *bp++ = *cp; - *bp = '\0'; + if (len > 1) { + *bp++ = *cp; + *bp = '\0'; + len--; + } } }