Author: rmeggins
Update of /cvs/dirsec/adminserver/admserv/cgi-src40
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv28761/adminserver/admserv/cgi-src40
Modified Files:
admpw.c config.c download.c dsconfig.c help.c htmladmin.c
listOldSrvs.c mergeConfig.cpp migrateConfig.c monreplication.c
restartsrv.c sec-activate.c security.c snmpconf.c snmpmctl.c
start_config_ds.c statpingserv.c stopsrv.c ugdsconfig.c
userinfo.c viewdata.c viewlog.c
Log Message:
Bug(s) fixed: 186280
Bug Description: adminserver: Close potential security vulnerabilities
in CGI code
Reviewed by: Rob, Pete, Nathan, Noriko (Thanks!)
Fix Description: Most of this just involves making sure that we use
PR_snprintf/PL_strncpyz/PL_strcatn where able, or just making sure we
use snprintf/strncpy/strncat correctly and null terminate the buffers.
I also got rid of some dead code, unused variables, and the like. There
are a few cases that are more complex that I have specified below. In
some cases I had to change the function signature to add a size
parameter in cases where the function was copying to a given char * and
the size was assumed (in most cases this was safe but it's still dangerous).
Platforms tested: Fedora Core 5
Flag Day: no
Doc impact: no
Index: admpw.c
===================================================================
RCS file: /cvs/dirsec/adminserver/admserv/cgi-src40/admpw.c,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -r1.4 -r1.5
--- admpw.c 18 Aug 2005 18:59:03 -0000 1.4
+++ admpw.c 31 Mar 2006 22:58:20 -0000 1.5
@@ -112,8 +112,8 @@
char resPath[256], *execPath;
execPath = getcwd(resPath, 256);
if (execPath) {
- strcpy(resPath, execPath);
- strcat(resPath, "/property");
+ PL_strncpyz(resPath, execPath, sizeof(resPath));
+ PL_strcatn(resPath, sizeof(resPath), "/property");
i18nResource = res_init_resource(resPath, RESOURCE_FILE);
}
if (getenv("HTTP_ACCEPT_LANGUAGE")) {
@@ -301,7 +301,6 @@
FILE *f;
int cnt;
static char filename[BIG_LINE];
- static char inbuf[BIG_LINE];
static char outbuf[BIG_LINE];
PR_snprintf(filename, sizeof(filename), "%s/admpw", getenv("ADMSERV_ROOT"));
Index: config.c
===================================================================
RCS file: /cvs/dirsec/adminserver/admserv/cgi-src40/config.c,v
retrieving revision 1.5
retrieving revision 1.6
diff -u -r1.5 -r1.6
--- config.c 18 Aug 2005 18:59:03 -0000 1.5
+++ config.c 31 Mar 2006 22:58:20 -0000 1.6
@@ -86,7 +86,7 @@
static int update_conf(char *file, char *name, char *val);
static int validate_addr(char* ip);
static int validate_logfile(char* name);
-static int get_logfile_path(char *name, char *buf);
+static int get_logfile_path(char *name, char *buf, size_t bufsize);
#ifdef XP_UNIX
static int rename_pidlog_file(PsetHndl pset, char* newname);
static int change_uid_all(char *dir, int curuid, int newuid);
@@ -132,8 +132,8 @@
execPath = getcwd(resPath, 256);
if (execPath) {
- strcpy(resPath, execPath);
- strcat(resPath, "/property");
+ PL_strncpyz(resPath, execPath, sizeof(resPath));
+ PL_strcatn(resPath, sizeof(resPath), "/property");
i18nResource = res_init_resource(resPath, RESOURCE_FILE);
}
valsbuf[0] = NULL;
@@ -308,14 +308,15 @@
nl = createAttrNameList(cnt);
x = 0; i = 0;
while (inputs[x] && *(inputs[x]) != '\0') {
- char namebuf[128], *cptr;
- int j;
- memset(namebuf, '\0', 128);
- cptr = inputs[x++];
- j = 0;
- while (*cptr != '=') namebuf[j++] = *cptr++;
+ char *begin, *end;
+ begin = inputs[x];
+ end = strchr(inputs[x++], '=');
+ if (end) {
+ char *name = PL_strndup(begin, end-begin);
/* Ignore "op" */
- if (strncasecmp(namebuf, "op", 2)) addName(nl, i++, namebuf);
+ if (strncasecmp(name, "op", 2)) addName(nl, i++, name);
+ PL_strfree(name);
+ }
}
resultList = psetGetAttrList(pset, nl, &errorCode);
@@ -496,12 +497,12 @@
if (valptr && valptr[0] ) {
char line[BIG_LINE];
int port = read_adm_conf();
- snprintf(line, BIG_LINE, "%s:%d", valptr, port);
+ PR_snprintf(line, sizeof(line), "%s:%d", valptr, port);
err = update_conf("console.conf", "Listen", line);
} else {
char line[BIG_LINE];
int port = read_adm_conf();
- snprintf(line, BIG_LINE, "%d", port);
+ PR_snprintf(line, sizeof(line), "%d", port);
err = update_conf("console.conf", "Listen", line);
}
}
@@ -523,8 +524,8 @@
else {
char newpath[BIG_LINE];
char pathline[BIG_LINE];
- get_logfile_path(valptr, newpath);
- snprintf(pathline, BIG_LINE, "%s %s", newpath, "common");
+ get_logfile_path(valptr, newpath, sizeof(newpath));
+ PR_snprintf(pathline, sizeof(pathline), "%s %s", newpath, "common");
err = update_conf("console.conf", "CustomLog", pathline);
}
}
@@ -544,7 +545,7 @@
}
else {
char newpath[BIG_LINE];
- get_logfile_path(valptr, newpath);
+ get_logfile_path(valptr, newpath, sizeof(newpath));
err = update_conf("console.conf", "ErrorLog", newpath);
}
}
@@ -707,7 +708,6 @@
FILE *f;
static char filename[BIG_LINE];
static char inbuf[BIG_LINE];
- static char buf[BIG_LINE];
static int port = -1;
PR_snprintf(filename, sizeof(filename), "%s/adm.conf", getenv("ADMSERV_ROOT"));
@@ -753,7 +753,7 @@
f = fopen(filename, "r");
if (f==NULL) {
char msg[BIG_LINE];
- snprintf(msg, BIG_LINE, "Cannot open file %s for reading", filename);
+ PR_snprintf(msg, BIG_LINE, "Cannot open file %s for reading", filename);
rpt_err(SYSTEM_ERROR, msg, NULL, NULL);
}
@@ -784,7 +784,7 @@
f = fopen(filename, "w");
if (f==NULL) {
char msg[BIG_LINE];
- snprintf(msg, BIG_LINE, "Cannot open file %s for writing", filename);
+ PR_snprintf(msg, sizeof(msg), "Cannot open file %s for writing", filename);
rpt_err(SYSTEM_ERROR, msg, NULL, NULL);
}
@@ -830,7 +830,6 @@
static int change_server_uid(PsetHndl pset, char* newuname) {
char *sroot = getenv("NETSITE_ROOT");
int errorCode;
- static char buf[BIG_LINE];
int newuid;
char *olduname = psetGetAttrSingleValue(pset,
"configuration.nsSuiteSpotUser",
@@ -1084,7 +1083,7 @@
FILE *f;
char fullname[BIG_LINE];
- get_logfile_path(name, fullname);
+ get_logfile_path(name, fullname, sizeof(fullname));
f = fopen(fullname, "a+");
if (f != NULL) {
@@ -1094,13 +1093,13 @@
return 0; /* error */
}
-static int get_logfile_path(char *name, char *buf) {
+static int get_logfile_path(char *name, char *buf, size_t bufsize) {
if (name[0] == '/') {
- PR_snprintf(buf, sizeof(buf),"%s",name);
+ PR_snprintf(buf, bufsize,"%s",name);
}
else {
- PR_snprintf(buf, sizeof(buf),"%s/%s", getenv("NETSITE_ROOT"), name);
+ PR_snprintf(buf, bufsize,"%s/%s", getenv("NETSITE_ROOT"), name);
}
return 0;
Index: download.c
===================================================================
RCS file: /cvs/dirsec/adminserver/admserv/cgi-src40/download.c,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -r1.4 -r1.5
--- download.c 18 Aug 2005 18:59:03 -0000 1.4
+++ download.c 31 Mar 2006 22:58:20 -0000 1.5
@@ -35,6 +35,7 @@
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
+#include <stdarg.h>
#ifdef XP_UNIX
# include <dirent.h>
@@ -74,6 +75,18 @@
#define DSGW_BLOCK "<dsgw_menu_block>"
#define DSGW_BLOCK_CLOSE "</dsgw_menu_block>"
+static int
+safe_snprintf(char *buf, size_t size, const char *fmt, ...)
+{
+ int ret;
+ va_list ap;
+ va_start(ap, fmt);
+ ret = vsnprintf(buf, size, fmt, ap);
+ va_end(ap);
+ buf[size-1] = 0;
+ return ret;
+}
+
int
error_exit(char *msg)
{
@@ -93,7 +106,7 @@
error_exit("NETSITE_ROOT not found");
/* Check whether dsgw is installed */
- snprintf(path, sizeof(path), "%s%cdsgw", serverroot, FILE_SEP);
+ safe_snprintf(path, sizeof(path), "%s%cdsgw", serverroot, FILE_SEP);
if (!(dp1 = dir_open(path)))
{
@@ -120,7 +133,7 @@
/* build list of supported downloads of the form <sr>/dist/<OSname>/n*.zip */
- snprintf(path, sizeof(path), "%s%cdist", serverroot, FILE_SEP);
+ safe_snprintf(path, sizeof(path), "%s%cdist", serverroot, FILE_SEP);
baselen = strlen(path);
@@ -134,7 +147,7 @@
continue;
/* check if this is a dir and has an executable */
- snprintf(&(path[baselen]), sizeof(path), "%c%s", FILE_SEP, dir_name(ep1));
+ safe_snprintf(&(path[baselen]), sizeof(path), "%c%s", FILE_SEP, dir_name(ep1));
if (!(dp2 = dir_open(path)))
continue;
@@ -148,7 +161,7 @@
!STRNCASECMP(dir_name(ep2), "winmcc", 6))
{
platforms[count] = STRDUP(dir_name(ep1));
- snprintf(line, sizeof(line), "%s:%s", dir_name(ep1), dir_name(ep2));
+ safe_snprintf(line, sizeof(line), "%s:%s", dir_name(ep1), dir_name(ep2));
paths[count++] = STRDUP(line);
}
}
@@ -187,7 +200,7 @@
loc = strtok(strdup(acceptLanguage), ",");
while (1)
{
- snprintf(line, sizeof(line), "..%cjava%chtml%c%c%c%cstart-console.html", FILE_SEP, FILE_SEP, FILE_SEP, loc[0],loc[1],FILE_SEP);
+ safe_snprintf(line, sizeof(line), "..%cjava%chtml%c%c%c%cstart-console.html", FILE_SEP, FILE_SEP, FILE_SEP, loc[0],loc[1],FILE_SEP);
if ((html = fopen(line, "r")) != NULL)
{
break;
@@ -197,7 +210,7 @@
loc = strtok(NULL, ", ");
if (loc == NULL)
{
- snprintf(line, sizeof(line), "..%cjava%chtml%cstart-console.html", FILE_SEP, FILE_SEP, FILE_SEP);
+ safe_snprintf(line, sizeof(line), "..%cjava%chtml%cstart-console.html", FILE_SEP, FILE_SEP, FILE_SEP);
if ((html = fopen(line, "r")) == NULL)
{
error_exit("start-console.html not found");
Index: dsconfig.c
===================================================================
RCS file: /cvs/dirsec/adminserver/admserv/cgi-src40/dsconfig.c,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -r1.4 -r1.5
--- dsconfig.c 18 Aug 2005 18:59:03 -0000 1.4
+++ dsconfig.c 31 Mar 2006 22:58:20 -0000 1.5
@@ -132,8 +132,8 @@
char resPath[256], *execPath;
execPath = getcwd(resPath, 256);
if (execPath) {
- strcpy(resPath, execPath);
- strcat(resPath, "/property");
+ PL_strncpyz(resPath, execPath, sizeof(resPath));
+ PL_strcatn(resPath, sizeof(resPath), "/property");
i18nResource = res_init_resource(resPath, RESOURCE_FILE);
}
if (getenv("HTTP_ACCEPT_LANGUAGE")) {
Index: help.c
===================================================================
RCS file: /cvs/dirsec/adminserver/admserv/cgi-src40/help.c,v
retrieving revision 1.5
retrieving revision 1.6
diff -u -r1.5 -r1.6
--- help.c 18 Aug 2005 18:59:03 -0000 1.5
+++ help.c 31 Mar 2006 22:58:20 -0000 1.6
@@ -31,6 +31,7 @@
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
+#include <stdarg.h>
#ifdef XP_UNIX
# include <dirent.h>
@@ -85,6 +86,18 @@
static int debugPrintout = 0;
static int didContentHeader = 0;
+static int
+safe_snprintf(char *buf, size_t size, const char *fmt, ...)
+{
+ int ret;
+ va_list ap;
+ va_start(ap, fmt);
+ ret = vsnprintf(buf, size, fmt, ap);
+ va_end(ap);
+ buf[size-1] = 0;
+ return ret;
+}
+
int
parse_query_string(char *qs, char **name[], char **val[])
{
@@ -230,7 +243,7 @@
in the server installation */
loc = strtok(strdup(localeList), ",");
while (1){
- snprintf(path, sizeof(path), "%s%c%c%c", BASE_DIR, FILE_SEP, loc[0], loc[1]);
+ safe_snprintf(path, sizeof(path), "%s%c%c%c", BASE_DIR, FILE_SEP, loc[0], loc[1]);
if (dir_open(path)) {
/* return only the first 2 characters of the language code e.g. return en for en-US */
loc[2] = '\0';
@@ -239,7 +252,7 @@
loc = strtok(NULL, ",");
if (!loc) {
/* default to English (en) */
- snprintf(path, sizeof(path), "%s%c%s", BASE_DIR, FILE_SEP, DEFAULT_LANG);
+ safe_snprintf(path, sizeof(path), "%s%c%s", BASE_DIR, FILE_SEP, DEFAULT_LANG);
if (dir_open(path))
return DEFAULT_LANG;
else
@@ -255,8 +268,7 @@
{
char path[PATH_LENGTH];
char base[PATH_LENGTH];
- char dir[PATH_LENGTH];
- char *dirp, *contentp;
+ char *dirp;
FILE *file = NULL;
if (debugPrintout)
@@ -266,11 +278,11 @@
/* Open the target file and return the contents */
- snprintf(path, sizeof(path), "%s%c%s%c%s%c%s", BASE_DIR, FILE_SEP, locale, FILE_SEP,
+ safe_snprintf(path, sizeof(path), "%s%c%s%c%s%c%s", BASE_DIR, FILE_SEP, locale, FILE_SEP,
product, FILE_SEP, content);
if (!(file = fopen(path, "r")))
{
- snprintf(path, sizeof(path), "unable to open file: %s", path);
+ safe_snprintf(path, sizeof(path), "unable to open file: %s", path);
if (debugPrintout)
{
printf("%s<P>\n", path);
@@ -284,14 +296,12 @@
}
/* spit out the output, inserting a BASE tag into the HEAD block */
- contentp = content;
- dirp = dir;
- while (*contentp && (*contentp != FILE_SEP))
- {
- *dirp++ = *contentp++;
+ if (dirp = strchr(content, FILE_SEP)) {
+ safe_snprintf(base, sizeof(base), "<base href=\"/%s/%s/%s/help/%.*s/\">", "manual", locale, product,
+ (dirp-content), content);
+ } else {
+ safe_snprintf(base, sizeof(base), "<base href=\"/%s/%s/%s/help/\">", "manual", locale, product);
}
- *dirp = 0;
- snprintf(base, sizeof(base), "<base href=\"/%s/%s/%s/help/%s/\">", "manual", locale, product, dir);
if (!didContentHeader)
{
printf("Content-type: text/html\n\n");
@@ -325,7 +335,7 @@
/* open a frameset file, either from the product dir, or the master file
* in the help dir. */
- snprintf(path, sizeof(path), "%s%c%s%c%s%c%s", BASE_DIR, FILE_SEP, locale, FILE_SEP, product, FILE_SEP, FRAMESET_FILE);
+ safe_snprintf(path, sizeof(path), "%s%c%s%c%s%c%s", BASE_DIR, FILE_SEP, locale, FILE_SEP, product, FILE_SEP, FRAMESET_FILE);
if (debugPrintout)
{
printf("opening frameset file: %s<P>\n", path);
@@ -333,7 +343,7 @@
if (!(frameset = fopen(path, "r")))
{
/* product frameset failed, so try global one */
- snprintf(path, sizeof(path), "%s", FRAMESET_FILE);
+ safe_snprintf(path, sizeof(path), "%s", FRAMESET_FILE);
if (!(frameset = fopen(path, "r")))
{
if (debugPrintout)
@@ -467,7 +477,7 @@
printf( "Map file parameter: %s<P>\n", mapfile );
}
- snprintf(path, sizeof(path), "%s%c%s%c%s%c%s", BASE_DIR, FILE_SEP, locale,
+ safe_snprintf(path, sizeof(path), "%s%c%s%c%s%c%s", BASE_DIR, FILE_SEP, locale,
FILE_SEP, product, FILE_SEP, mapfile);
if (debugPrintout)
{
@@ -565,7 +575,7 @@
/* first, check for contents.htm in this directory */
- snprintf(path, sizeof(path), "%s%c%s", dirpath, FILE_SEP, CONTENTS_FILE);
+ safe_snprintf(path, sizeof(path), "%s%c%s", dirpath, FILE_SEP, CONTENTS_FILE);
if ((fp = fopen(path, "r")))
{
@@ -610,7 +620,7 @@
dumpTitle(getProductName(dir_name(d)));
}
- snprintf(path, sizeof(path), "%s%c%s", dirpath, FILE_SEP, dir_name(d));
+ safe_snprintf(path, sizeof(path), "%s%c%s", dirpath, FILE_SEP, dir_name(d));
check_directory(path, prefix, suffix, dirDepth+1);
if (dirDepth == 0)
@@ -669,7 +679,7 @@
*endp = '\0';
- snprintf(base, sizeof(base), "%s%c%s", BASE_DIR, FILE_SEP, locale);
+ safe_snprintf(base, sizeof(base), "%s%c%s", BASE_DIR, FILE_SEP, locale);
check_directory(base, prefix, suffix, 0);
}
Index: htmladmin.c
===================================================================
RCS file: /cvs/dirsec/adminserver/admserv/cgi-src40/htmladmin.c,v
retrieving revision 1.5
retrieving revision 1.6
diff -u -r1.5 -r1.6
--- htmladmin.c 2 Nov 2005 01:15:17 -0000 1.5
+++ htmladmin.c 31 Mar 2006 22:58:20 -0000 1.6
@@ -644,8 +644,8 @@
while(ptr3[0] == ' ')
ptr3++; /* remove spaces */
- PR_snprintf(dn, BIG_LINE, "ou=\"%s\", ou=UserPreferences, %s", binddn, ptr3);
- PR_snprintf(filter, BIG_LINE, "(&(objectclass=nscustomview)(nsdisplayname=%s))", view);
+ PR_snprintf(dn, sizeof(dn), "ou=\"%s\", ou=UserPreferences, %s", binddn, ptr3);
+ PR_snprintf(filter, sizeof(filter), "(&(objectclass=nscustomview)(nsdisplayname=%s))", view);
ldapError = ldap_search_s(server, dn, LDAP_SCOPE_SUBTREE,
filter, NULL, 0, &result);
@@ -659,7 +659,7 @@
if(!vals || !strcmp(vals[0], "<none>")) {
/* not in the private views, maybe in the public views? */
- PR_snprintf(dn, BIG_LINE, "ou=Global Preferences, %s", ptr3);
+ PR_snprintf(dn, sizeof(dn), "ou=Global Preferences, %s", ptr3);
ldapError = ldap_search_s(server, dn, LDAP_SCOPE_SUBTREE,
filter, NULL, 0, &result);
if(ldapError != LDAP_SUCCESS)
@@ -758,7 +758,7 @@
char *admConf = (char *)malloc(strlen(getenv("ADMSERV_ROOT"))+ /*<sr>/admin-serv/config*/
strlen("/adm.conf")+1);
- sprintf(admConf, "%s%cadm.conf", getenv("ADMSERV_ROOT"), FILE_PATHSEP);
+ PR_snprintf(admConf, sizeof(admConf), "%s%cadm.conf", getenv("ADMSERV_ROOT"), FILE_PATHSEP);
/* get host name(FQDN) and port number from config file */
f = fopen(admConf, "r");
@@ -797,7 +797,7 @@
char *admConf = (char *)malloc(strlen(getenv("ADMSERV_ROOT"))+ /*<sr>/admin-serv/config*/
strlen("/adm.conf")+1);
- sprintf(admConf, "%s%cadm.conf", getenv("ADMSERV_ROOT"), FILE_PATHSEP);
+ PR_snprintf(admConf, sizeof(admConf), "%s%cadm.conf", getenv("ADMSERV_ROOT"), FILE_PATHSEP);
/* get host name(FQDN) and port number from config file */
f = fopen(admConf, "r");
@@ -830,7 +830,7 @@
char *admConf = (char *)malloc(strlen(getenv("ADMSERV_ROOT"))+ /*<sr>/admin-serv/config*/
strlen("/adm.conf")+1);
- sprintf(admConf, "%s%cadm.conf", getenv("ADMSERV_ROOT"), FILE_PATHSEP);
+ PR_snprintf(admConf, sizeof(admConf), "%s%cadm.conf", getenv("ADMSERV_ROOT"), FILE_PATHSEP);
/* get host name(FQDN) and port number from config file */
f = fopen(admConf, "r");
@@ -928,13 +928,13 @@
}
if(accesslog && errorlog && strcmp(accesslog, errorlog))
- PR_snprintf(dirs, BIG_LINE, "%s|%s", accesslog, errorlog);
+ PR_snprintf(dirs, sizeof(dirs), "%s|%s", accesslog, errorlog);
else if(accesslog)
- PL_strncpy(dirs, accesslog, BIG_LINE);
+ PL_strncpyz(dirs, accesslog, sizeof(dirs));
else if(errorlog)
- PL_strncpy(dirs, errorlog, BIG_LINE);
+ PL_strncpyz(dirs, errorlog, sizeof(dirs));
else
- PR_snprintf(dirs, BIG_LINE, "admin-serv%clogs", FILE_PATHSEP);
+ PR_snprintf(dirs, sizeof(dirs), "admin-serv%clogs", FILE_PATHSEP);
return strdup(dirs);
}
@@ -970,7 +970,7 @@
dirs = strdup(ptr);
else {
dirs = (char *)realloc(dirs, (strlen(dirs) + strlen(ptr) + 1));
- PR_snprintf(dirs, BIG_LINE, "%s|%s", dirs, ptr);
+ sprintf(dirs, "%s|%s", dirs, ptr);
}
ldap_value_free(vals);
}
@@ -1196,7 +1196,7 @@
continue;
if(view)
- PR_snprintf(viewparam, BIG_LINE, "&view=%s", view);
+ PR_snprintf(viewparam, sizeof(viewparam), "&view=%s", view);
if((vals = ldap_get_values(server, sie_entry, SIE_SERVERID_ATTR)) != NULL) {
@@ -1248,6 +1248,7 @@
if(running == 1) {
if(is_local_admin(server_host, server_port[0])) {
+ /* if this ever changes, use PR_smprintf instead of malloc + sprintf */
href = (char *)malloc(strlen(getResourceString(DBT_OUTPUT_TOPOLOGY_LOCAL_SERVER_ENTRY)) +
strlen(admin_url) + 1);
sprintf(href,
@@ -1256,6 +1257,7 @@
}
else {
+ /* if this ever changes, use PR_smprintf instead of malloc + sprintf */
href = (char *)malloc(strlen(getResourceString(DBT_OUTPUT_TOPOLOGY_SERVER_ENTRY)) +
strlen(htmladmin_strdup_escaped(ldap_get_dn(server, sie_entry))) +
(view ? strlen(viewparam) : 0) +
@@ -1268,6 +1270,7 @@
}
+ /* if this ever changes, use PR_smprintf instead of malloc + sprintf */
info_link = (char *)malloc(strlen(getResourceString(DBT_OUTPUT_TOPOLOGY_ADMIN_INFO_LINK)) + strlen(admin_url) + strlen(htmladmin_strdup_escaped(ldap_get_dn(server, sie_entry))) + 2);
sprintf(info_link,
(const char*)getResourceString(DBT_OUTPUT_TOPOLOGY_ADMIN_INFO_LINK),
@@ -1275,6 +1278,7 @@
htmladmin_strdup_escaped(ldap_get_dn(server, sie_entry)));
+ /* if this ever changes, use PR_smprintf instead of malloc + sprintf */
log_link = (char *)malloc(strlen(getResourceString(DBT_OUTPUT_TOPOLOGY_ADMIN_LOG_LINK)) + strlen(admin_url) + strlen(htmladmin_strdup_escaped(vals[0])) + strlen(htmladmin_strdup_escaped(dirs)) + 2);
sprintf(log_link,
(const char*)getResourceString(DBT_OUTPUT_TOPOLOGY_ADMIN_LOG_LINK),
@@ -1301,6 +1305,7 @@
running = server_status(server_host, server_port[0]);
if(running == 1) {
+ /* if this ever changes, use PR_smprintf instead of malloc + sprintf */
href = (char *)malloc(strlen(getResourceString(DBT_OUTPUT_TOPOLOGY_SERVER_RUNNING)) +
strlen(htmladmin_strdup_escaped(ldap_get_dn(server, sie_entry))) +
(view ? strlen(viewparam) : 0) +
@@ -1312,6 +1317,7 @@
}
else if(running == 0) {
+ /* if this ever changes, use PR_smprintf instead of malloc + sprintf */
href = (char *)malloc(strlen(getResourceString(DBT_OUTPUT_TOPOLOGY_SERVER_STOP)) +
strlen(htmladmin_strdup_escaped(ldap_get_dn(server, sie_entry))) +
(view ? strlen(viewparam) : 0) +
@@ -1321,16 +1327,19 @@
view ? viewparam : "");
}
+ /* if this ever changes, use PR_smprintf instead of malloc + sprintf */
info_link = (char *)malloc(strlen(getResourceString(DBT_OUTPUT_TOPOLOGY_DIRECTORY_INFO_LINK)) + strlen(admin_url) + strlen(htmladmin_strdup_escaped(ldap_get_dn(server, sie_entry))) + 2);
sprintf(info_link, getResourceString(DBT_OUTPUT_TOPOLOGY_DIRECTORY_INFO_LINK),
admin_url,
htmladmin_strdup_escaped(ldap_get_dn(server, sie_entry)));
+ /* if this ever changes, use PR_smprintf instead of malloc + sprintf */
log_link = (char *)malloc(strlen(getResourceString(DBT_OUTPUT_TOPOLOGY_DIRECTORY_LOG_LINK)) + strlen(admin_url) + strlen(htmladmin_strdup_escaped(vals[0])) + 2);
sprintf(log_link, (const char*)getResourceString(DBT_OUTPUT_TOPOLOGY_DIRECTORY_LOG_LINK),
admin_url,
htmladmin_strdup_escaped(vals[0]));
+ /* if this ever changes, use PR_smprintf instead of malloc + sprintf */
repl_link = (char *)malloc(strlen(getResourceString(DBT_OUTPUT_TOPOLOGY_DIRECTORY_REPL_LINK)) + strlen(admin_url)*2 + strlen(htmladmin_strdup_escaped(host)) + strlen(getenv("NETSITE_ROOT")) + /*space for port num*/ 12);
sprintf(repl_link, (const char*)getResourceString(DBT_OUTPUT_TOPOLOGY_DIRECTORY_REPL_LINK),
admin_url,
@@ -1347,105 +1356,6 @@
(running == 1) ? getResourceString(DBT_OUTPUT_TOPOLOGY_ON) : ((running == 0) ? getResourceString(DBT_OUTPUT_TOPOLOGY_OFF) : getResourceString(DBT_OUTPUT_TOPOLOGY_UNKNOWN)),
(running == 1 || running == 0) ? href : "");
}
- else if(strstr(ldap_get_dn(server, sie_entry), "Messaging")) {
- /*
- * Messaging Server - logs we get from DS, plus we need to display 3 components under the SIE:
- * imap, pop and smtp. */
- char *dirs = MS_dirs(server, sie_entry, serverroot);
- char *services[3];
- int count;
- char *service_name;
-
- services[0] = strdup("IMAP");
- services[1] = strdup("POP");
- services[2] = strdup("SMTP");
-
-
- if(dirs) {
-
- info_link = (char *)malloc(strlen(getResourceString(DBT_OUTPUT_TOPOLOGY_MSG_INFO_LINK)) + strlen(admin_url) + strlen(htmladmin_strdup_escaped(ldap_get_dn(server, sie_entry))) + 2);
- sprintf(info_link,
- (const char*)getResourceString(DBT_OUTPUT_TOPOLOGY_MSG_INFO_LINK),
- admin_url,
- htmladmin_strdup_escaped(ldap_get_dn(server, sie_entry)));
-
- log_link = (char *)malloc(strlen(getResourceString(DBT_OUTPUT_TOPOLOGY_MSG_LOG_LINK)) + strlen(admin_url) + strlen(htmladmin_strdup_escaped(vals[0])) + strlen(htmladmin_strdup_escaped(dirs)) + 2);
- sprintf(log_link, (const char*)getResourceString(DBT_OUTPUT_TOPOLOGY_MSG_LOG_LINK),
- admin_url,
- htmladmin_strdup_escaped(vals[0]),
- htmladmin_strdup_escaped(dirs));
-
-
- fprintf(stdout,
- (const char*)getResourceString(DBT_OUTPUT_TOPOLOGY_MSG_LINKS),
- info_link,
- log_link);
- }
-
- for(count=0; count < 3; count++) {
-
-
- fprintf(stdout,
- (const char*)getResourceString(DBT_OUTPUT_TOPOLOGY_MSG_SERVICE),
- services[count]);
-
- switch(count) {
- case 0:
- service_name = (char *)malloc(strlen("cn=imap, cn=service, cn=configuration, ") + strlen(ldap_get_dn(server, sie_entry)) + 1);
- sprintf(service_name, "cn=imap, cn=service, cn=configuration, %s",
- ldap_get_dn(server, sie_entry));
- break;
- case 1:
- service_name = (char *)malloc(strlen("cn=pop, cn=service, cn=configuration, ") + strlen(ldap_get_dn(server, sie_entry)) + 1);
- sprintf(service_name, "cn=pop, cn=service, cn=configuration, %s",
- ldap_get_dn(server, sie_entry));
- break;
- case 2:
- service_name = (char *)malloc(strlen("cn=smtp, cn=service, cn=configuration, ") + strlen(ldap_get_dn(server, sie_entry)) + 1);
- sprintf(service_name, "cn=smtp, cn=service, cn=configuration, %s",
- ldap_get_dn(server, sie_entry));
- break;
- }
-
- running = server_status(server_host, server_port[count]);
- if(running == 1) {
-
- href = (char *)malloc(strlen(getResourceString(DBT_OUTPUT_TOPOLOGY_MSG_OFF)) +
- strlen(htmladmin_strdup_escaped(service_name)) +
- (view ? strlen(viewparam) : 0) +
- 1);
- sprintf(href,
- (const char*)getResourceString(DBT_OUTPUT_TOPOLOGY_MSG_OFF),
- htmladmin_strdup_escaped(service_name),
- view ? viewparam : "");
- }
- else if(running == 0) {
-
- href = (char *)malloc(strlen(getResourceString(DBT_OUTPUT_TOPOLOGY_MSG_ON)) +
- strlen(htmladmin_strdup_escaped(service_name)) +
- (view ? strlen(viewparam) : 0) +
- 1);
- sprintf(href, (const char*)getResourceString(DBT_OUTPUT_TOPOLOGY_MSG_ON),
- htmladmin_strdup_escaped(service_name),
- view ? viewparam : "");
- }
-
-
- fprintf(stdout,
- (const char*)getResourceString(DBT_OUTPUT_TOPOLOGY_MSG_STATUS),
- (running == 1) ? getResourceString(DBT_OUTPUT_TOPOLOGY_ON) : ((running == 0) ? getResourceString(DBT_OUTPUT_TOPOLOGY_OFF) : getResourceString(DBT_OUTPUT_TOPOLOGY_UNKNOWN) ),
- (running == 1 || running == 0) ? href : "");
-
-
-
-
-
-
-
- free(service_name);
-
- }
- }
else if(strstr(ldap_get_dn(server, sie_entry), "Enterprise")) {
/*
* Enterprise Server - local config file.
@@ -1541,55 +1451,6 @@
(running == 1) ? href : "");
}
- else if((strstr(ldap_get_dn(server, sie_entry), "Application")) ||
- (strstr(ldap_get_dn(server, sie_entry), "Biller"))) {
- /* BillerXpert or NAS - the log directory is hardcoded to <instance-root>/logs */
-
- running = server_status(server_host, server_port[0]);
-
- if(running == 1) {
-
- href = (char *)malloc(strlen(getResourceString(DBT_OUTPUT_TOPOLOGY_OTHER_ON)) +
- strlen(htmladmin_strdup_escaped(ldap_get_dn(server, sie_entry))) +
- (view ? strlen(viewparam) : 0) +
- 1);
- sprintf(href, (const char*)getResourceString(DBT_OUTPUT_TOPOLOGY_OTHER_ON),
- htmladmin_strdup_escaped(ldap_get_dn(server, sie_entry)),
- view ? viewparam : "");
- }
- else if(running == 0) {
-
- href = (char *)malloc(strlen(getResourceString(DBT_OUTPUT_TOPOLOGY_OTHER_OFF)) +
- strlen(htmladmin_strdup_escaped(ldap_get_dn(server, sie_entry))) +
- (view ? strlen(viewparam) : 0) +
- 1);
- sprintf(href, (const char*)getResourceString(DBT_OUTPUT_TOPOLOGY_OTHER_OFF),
- htmladmin_strdup_escaped(ldap_get_dn(server, sie_entry)),
- view ? viewparam : "");
- }
-
- info_link = (char *)malloc(strlen(getResourceString(DBT_OUTPUT_TOPOLOGY_OTHER_INFO_LINK)) + strlen(admin_url) + strlen(htmladmin_strdup_escaped(ldap_get_dn(server, sie_entry))) + 2);
- sprintf(info_link,
- (const char*)getResourceString(DBT_OUTPUT_TOPOLOGY_OTHER_INFO_LINK),
- admin_url,
- htmladmin_strdup_escaped(ldap_get_dn(server, sie_entry)));
-
- log_link = (char *)malloc(strlen(getResourceString(DBT_OUTPUT_TOPOLOGY_OTHER_LOG_LINK)) + strlen(admin_url) + strlen(htmladmin_strdup_escaped(vals[0])) + strlen(htmladmin_strdup_escaped(vals[0])) + 3);
- sprintf(log_link,
- (const char*)getResourceString(DBT_OUTPUT_TOPOLOGY_OTHER_LOG_LINK),
- admin_url,
- htmladmin_strdup_escaped(vals[0]),
- htmladmin_strdup_escaped(vals[0]),
- FILE_PATHSEP);
-
- fprintf(stdout,
- (const char*)getResourceString(DBT_OUTPUT_TOPOLOGY_STATUS),
- info_link,
- log_link,
- (running == 1) ? getResourceString(DBT_OUTPUT_TOPOLOGY_ON) : ((running == -1) ? getResourceString(DBT_OUTPUT_TOPOLOGY_UNKNOWN) : getResourceString(DBT_OUTPUT_TOPOLOGY_OFF)),
- (running == 1) ? href : "");
-
- }
fprintf(stdout, getResourceString(DBT_OUTPUT_TOPOLOGY_TABLE_FOOTER));
@@ -1637,10 +1498,10 @@
nbuf = (bufstruct *) new_buffer(NBUF_SIZE);
- tmp = (unsigned char *)malloc(strlen(binddn) + strlen(bindpw) + 2);
- auth = (unsigned char *)malloc(2024);
- sprintf((char *)tmp, "%s:%s", binddn, bindpw);
+ tmp = (unsigned char *)PR_smprintf("%s:%s", binddn, bindpw);
+ auth = (unsigned char *)malloc(strlen((char *)tmp)*2+1);
do_uuencode(tmp, auth, strlen((char *)tmp));
+ PR_smprintf_free((char *)tmp);
if(strstr(admin_url, "https")) {
admin_host = strtok(buf+8, ":");
@@ -1751,10 +1612,10 @@
nbuf = (bufstruct *) new_buffer(NBUF_SIZE);
- tmp = (unsigned char *)malloc(strlen(binddn) + strlen(bindpw) + 2);
- auth = (unsigned char *)malloc(2024);
- sprintf((char *)tmp, "%s:%s", binddn, bindpw);
+ tmp = (unsigned char *)PR_smprintf("%s:%s", binddn, bindpw);
+ auth = (unsigned char *)malloc(strlen((char *)tmp)*2+1);
do_uuencode(tmp, auth, strlen((char *)tmp));
+ PR_smprintf_free((char *)tmp);
if(strstr(admin_url, "https")) {
admin_host = strtok(buf+8, ":");
@@ -1864,7 +1725,7 @@
int rv;
- PR_snprintf(line, BIG_LINE, "%s%cbin/admin/admin/bin/property", getenv("NETSITE_ROOT"), FILE_PATHSEP);
+ PR_snprintf(line, sizeof(line), "%s%cbin/admin/admin/bin/property", getenv("NETSITE_ROOT"), FILE_PATHSEP);
i18nResource = res_init_resource(line, RESOURCE_FILE);
acceptLanguage = "en";
if (lang) acceptLanguage = strdup(lang);
@@ -1883,7 +1744,7 @@
view = get_cgi_var("view", NULL, NULL);
if(view)
- PR_snprintf(viewparam, BIG_LINE, "&view=%s", view);
+ PR_snprintf(viewparam, sizeof(viewparam), "&view=%s", view);
/* In all cases, get the custom view. */
Index: listOldSrvs.c
===================================================================
RCS file: /cvs/dirsec/adminserver/admserv/cgi-src40/listOldSrvs.c,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -r1.4 -r1.5
--- listOldSrvs.c 18 Aug 2005 18:59:03 -0000 1.4
+++ listOldSrvs.c 31 Mar 2006 22:58:20 -0000 1.5
@@ -60,7 +60,7 @@
int
-readServersList(char* serverRoot, FILE *fstream, char *fileName, char* errorInfo)
+readServersList(char* serverRoot, FILE *fstream, char *fileName, char* errorInfo, size_t errorSize)
{
char line[1024];
int ln;
@@ -75,15 +75,15 @@
char *v;
++ln;
- switch( (t = admutil_getline(fstream, 1024, ln, line))) {
+ switch( (t = admutil_getline(fstream, sizeof(line), ln, line))) {
case -1:
fclose(fstream);
if (i18nResource &&
(errorMsg = res_getstring(i18nResource,
DBT_ERROR_READ_FILE,
acceptLanguage)))
- PR_snprintf(errorInfo, sizeof(errorInfo), errorMsg, fileName);
- else PR_snprintf(errorInfo, sizeof(errorInfo), "Error reading file: %s", fileName);
+ PR_snprintf(errorInfo, errorSize, errorMsg, fileName);
+ else PR_snprintf(errorInfo, errorSize, "Error reading file: %s", fileName);
return 0;
case 1:
fclose(fstream);
@@ -122,7 +122,7 @@
}
char**
-get_server_list(char* oldServerRoot, char* errorInfo) {
+get_server_list(char* oldServerRoot, char* errorInfo, size_t errorSize) {
PRDir *sr;
PRDirEntry *dirname;
@@ -145,14 +145,14 @@
(errMsg = res_getstring(i18nResource,
DBT_ERROR_OPEN_FILE,
acceptLanguage)))
- PR_snprintf(errorInfo, sizeof(errorInfo), errMsg, fileName);
+ PR_snprintf(errorInfo, errorSize, errMsg, fileName);
else
- PR_snprintf(errorInfo, sizeof(errorInfo), "Error open file: %s", fileName);
+ PR_snprintf(errorInfo, errorSize, "Error open file: %s", fileName);
return 0;
}
}
- if (!(result = readServersList(oldServerRoot, fstream, fileName, errorInfo))) {
+ if (!(result = readServersList(oldServerRoot, fstream, fileName, errorInfo, errorSize))) {
return NULL;
}
@@ -162,8 +162,8 @@
(errMsg = res_getstring(i18nResource,
DBT_ERROR_OPEN_DIR,
acceptLanguage)))
- PR_snprintf(errorInfo, sizeof(errorInfo), errMsg, oldServerRoot);
- else PR_snprintf(errorInfo, sizeof(errorInfo), "Error open directory: %s", oldServerRoot);
+ PR_snprintf(errorInfo, errorSize, errMsg, oldServerRoot);
+ else PR_snprintf(errorInfo, errorSize, "Error open directory: %s", oldServerRoot);
return NULL;
}
@@ -206,7 +206,7 @@
char *nameptr, *valptr, *val;
char error_info[128];
int setFlag = 0, getFlag = 0, forceSetFlag = 0;
- char resPath[256], *execPath, *tmpptr;
+ char *execPath, *tmpptr;
char *lang = getenv("HTTP_ACCEPT_LANGUAGE");
const char *errMsg = NULL;
#if 0
@@ -275,7 +275,7 @@
else rpt_err(INCORRECT_USAGE, "No old server root specified", NULL, NULL);
}
- server_list = get_server_list(oldSR, error_info);
+ server_list = get_server_list(oldSR, error_info, sizeof(error_info));
if (server_list) {
rpt_success(NULL);
Index: mergeConfig.cpp
===================================================================
RCS file: /cvs/dirsec/adminserver/admserv/cgi-src40/mergeConfig.cpp,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -r1.4 -r1.5
--- mergeConfig.cpp 29 Mar 2006 02:19:52 -0000 1.4
+++ mergeConfig.cpp 31 Mar 2006 22:58:20 -0000 1.5
@@ -311,14 +311,14 @@
while((start_ptr && *start_ptr != '\0') &&
(end_ptr && *end_ptr != '\0')) {
end_ptr[0] = '\0';
- strcat(replace_string, start_ptr);
- strcat(replace_string, dest_groupDN);
+ PL_strcatn(replace_string, sizeof(replace_string), start_ptr);
+ PL_strcatn(replace_string, sizeof(replace_string), dest_groupDN);
start_ptr = end_ptr + strlen(source_groupDN);
if(start_ptr && *start_ptr != '\0')
end_ptr = strstr(start_ptr, source_groupDN);
}
if(start_ptr && *start_ptr!= '\0')
- strcat(replace_string, start_ptr);
+ PL_strcatn(replace_string, sizeof(replace_string), start_ptr);
free(temp_string);
free(attribute_list[i]);
@@ -363,7 +363,7 @@
}
while(merge_rules[count]) {
- sprintf(temp, "{%s}", attrName);
+ PR_snprintf(temp, sizeof(temp), "{%s}", attrName);
if(strstr(merge_rules[count], temp))
break;
count++;
@@ -646,11 +646,11 @@
source_entry = ldap_next_entry(source_server, source_entry)) {
next_source_dn = ldap_get_dn(source_server, source_entry);
- strcpy(temp, next_source_dn);
+ PL_strncpyz(temp, next_source_dn, sizeof(temp));
temp2 = strchr(temp, ',');
temp2[2] = '\0'; // include the space
- strcpy(next_dest_dn, temp);
- strcat(next_dest_dn, dest_pref_dn);
+ PL_strncpyz(next_dest_dn, temp, sizeof(next_dest_dn));
+ PL_strcatn(next_dest_dn, sizeof(next_dest_dn), dest_pref_dn);
if(recursive_mergeGlobalPrefs(source_server,
next_source_dn,
@@ -816,7 +816,7 @@
/* ---------------------- INIT i18n ---------------------------------------- */
char *lang=getenv("HTTP_ACCEPT_LANGUAGE");
- sprintf(line, "%s%cbin/admin/admin/bin/property", server_root, FILE_PATHSEP);
+ PR_snprintf(line, sizeof(line), "%s%cbin/admin/admin/bin/property", server_root, FILE_PATHSEP);
i18nResource = res_init_resource(line, RESOURCE_FILE);
acceptLanguage = "en";
if (lang) acceptLanguage = strdup(lang);
@@ -848,7 +848,7 @@
if (source_binddn) rv = ADM_GetCurrentPassword(&err, &source_bindpw);
- sprintf(admroot, "%s%cadmin-serv%cconfig",
+ PR_snprintf(admroot, sizeof(admroot), "%s%cadmin-serv%cconfig",
server_root,
FILE_PATHSEP,
FILE_PATHSEP);
@@ -861,7 +861,7 @@
rv = ADMSSL_InitSimple();
if (rv) {
- sprintf(error_info, getResourceString(DBT_ADMSSL_INITFAIL), rv);
+ PR_snprintf(error_info, sizeof(error_info), getResourceString(DBT_ADMSSL_INITFAIL), rv);
rpt_err(APP_ERROR, error_info, NULL, NULL);
}
@@ -899,8 +899,7 @@
rpt_err(ELEM_MISSING, getResourceString(DBT_NO_SOURCE_GROUPDN), NULL, NULL);
- char *dest_basedn = (char *)malloc((strlen(dest_domain) + 20) * sizeof(char));
- sprintf(dest_basedn, "ou=%s, o=NetscapeRoot", dest_domain);
+ char *dest_basedn = PR_smprintf("ou=%s, o=NetscapeRoot", dest_domain);
temp = strdup(source_groupdn);
char *source_basedn = strtok(temp, ",");
@@ -910,13 +909,13 @@
if(source_basedn[0] == ' ')
source_basedn = &(source_basedn[1]);
- sprintf(dest_url, "ldap%s://%s:%s/%s",
+ PR_snprintf(dest_url, sizeof(dest_url), "ldap%s://%s:%s/%s",
(!strcmp(dest_secure, "1") ? "s" : ""),
dest_host,
dest_port,
dest_basedn);
- sprintf(source_url, "ldap%s://%s:%d/%s",
+ PR_snprintf(source_url, sizeof(source_url), "ldap%s://%s:%d/%s",
((admldapGetSecurity(ldapInfo)) ? "s" : ""),
admldapGetHost(ldapInfo),
admldapGetPort(ldapInfo),
@@ -1072,15 +1071,15 @@
isie_created = 1;
}
- strcat(sie_response, "SIE:");
- strcat(sie_response, sieEntry->entryDN());
- strcat(sie_response, "%0A");
+ PL_strcatn(sie_response, sizeof(sie_response), "SIE:");
+ PL_strcatn(sie_response, sizeof(sie_response), sieEntry->entryDN());
+ PL_strcatn(sie_response, sizeof(sie_response), "%0A");
} /* creating SIE's for current ISIE */
- strcat(isie_response, "ISIE:");
- strcat(isie_response, appEntry->entryDN());
- strcat(isie_response, "%0A");
+ PL_strcatn(isie_response, sizeof(isie_response), "ISIE:");
+ PL_strcatn(isie_response, sizeof(isie_response), appEntry->entryDN());
+ PL_strcatn(isie_response, sizeof(isie_response), "%0A");
/* ------------------------- MERGE ALL ENTRIES UNDER CURRENT ISIE --------------------------- */
@@ -1143,10 +1142,10 @@
char source_pref_dn[BIG_LINE];
char dest_pref_dn[BIG_LINE];
- strcpy(source_pref_dn, "ou=Global Preferences, ");
- strcat(source_pref_dn, source_basedn);
- strcpy(dest_pref_dn, "ou=Global Preferences, ");
- strcat(dest_pref_dn, dest_basedn);
+ PL_strncpyz(source_pref_dn, "ou=Global Preferences, ", sizeof(source_pref_dn));
+ PL_strcatn(source_pref_dn, sizeof(source_pref_dn), source_basedn);
+ PL_strncpyz(dest_pref_dn, "ou=Global Preferences, ", sizeof(dest_pref_dn));
+ PL_strcatn(dest_pref_dn, sizeof(dest_pref_dn), dest_basedn);
if(mergeGlobalPrefs(admldapGetHost(ldapInfo),
admldapGetPort(ldapInfo),
@@ -1169,7 +1168,7 @@
} /* GET */
- sprintf(response,
+ PR_snprintf(response, sizeof(response),
"%s%s",
sie_response,
isie_response);
Index: migrateConfig.c
===================================================================
RCS file: /cvs/dirsec/adminserver/admserv/cgi-src40/migrateConfig.c,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -r1.4 -r1.5
--- migrateConfig.c 18 Aug 2005 18:59:03 -0000 1.4
+++ migrateConfig.c 31 Mar 2006 22:58:20 -0000 1.5
@@ -140,8 +140,8 @@
execPath = getcwd(resPath, 256);
if (execPath) {
- strcpy(resPath, execPath);
- strcat(resPath, "/property");
+ PL_strncpyz(resPath, execPath, sizeof(resPath));
+ PL_strcatn(resPath, sizeof(resPath), "/property");
i18nResource = res_init_resource(resPath, RESOURCE_FILE);
}
@@ -349,12 +349,12 @@
if (val) {
char urlBuf[256];
char *tmpptr;
- PL_strcpy(urlBuf, val);
+ PL_strncpyz(urlBuf, val, sizeof(urlBuf));
tmpptr = PL_strrchr(urlBuf, ':');
if (tmpptr) {
tmpptr++;
*tmpptr = '\0';
- PL_strcat(urlBuf, valptr);
+ PL_strcatn(urlBuf, sizeof(urlBuf), valptr);
addSingleValueAttribute(updateList, i++, "adminurl", urlBuf);
}
}
@@ -430,7 +430,6 @@
char *lines[50];
int port;
const char *errMsg = NULL;
- char error_info[128];
PR_snprintf(filename, sizeof(filename), "%s/adm.conf", getenv("ADMSERV_ROOT"));
@@ -480,8 +479,6 @@
int linecnt=0;
char *lines[50];
int port;
- const char *errMsg = NULL;
- char error_info[128];
PR_snprintf(filename, sizeof(filename), "%s/magnus.conf", getenv("ADMSERV_ROOT"));
Index: monreplication.c
===================================================================
RCS file: /cvs/dirsec/adminserver/admserv/cgi-src40/monreplication.c,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -r1.4 -r1.5
--- monreplication.c 18 Aug 2005 18:59:03 -0000 1.4
+++ monreplication.c 31 Mar 2006 22:58:20 -0000 1.5
@@ -58,8 +58,8 @@
char resPath[256], *execPath;
execPath = getcwd(resPath, 256);
if (execPath) {
- strcpy(resPath, execPath);
- strcat(resPath, "/property");
+ PL_strncpyz(resPath, execPath, sizeof(resPath));
+ PL_strcatn(resPath, sizeof(resPath), "/property");
i18nResource = res_init_resource(resPath, RESOURCE_FILE);
}
if (getenv("HTTP_ACCEPT_LANGUAGE")) {
Index: restartsrv.c
===================================================================
RCS file: /cvs/dirsec/adminserver/admserv/cgi-src40/restartsrv.c,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -r1.4 -r1.5
--- restartsrv.c 18 Aug 2005 18:59:03 -0000 1.4
+++ restartsrv.c 31 Mar 2006 22:58:20 -0000 1.5
@@ -121,8 +121,8 @@
execPath = getcwd(resPath, 256);
if (execPath) {
- strcpy(resPath, execPath);
- strcat(resPath, "/property");
+ PL_strncpyz(resPath, execPath, sizeof(resPath));
+ PL_strcatn(resPath, sizeof(resPath), "/property");
i18nResource = res_init_resource(resPath, RESOURCE_FILE);
}
@@ -256,11 +256,8 @@
#ifdef XP_UNIX
static char * get_admserv_pid() {
char path[BIG_LINE];
- char newpath[BIG_LINE];
char *pidlog = (char*)get_pid_file();
- char *sroot = getenv("NETSITE_ROOT");
char inbuf[16];
- int errorCode;
FILE *f;
PR_snprintf(path, sizeof(path), "%s", pidlog);
Index: sec-activate.c
===================================================================
RCS file: /cvs/dirsec/adminserver/admserv/cgi-src40/sec-activate.c,v
retrieving revision 1.5
retrieving revision 1.6
diff -u -r1.5 -r1.6
--- sec-activate.c 18 Nov 2005 21:15:03 -0000 1.5
+++ sec-activate.c 31 Mar 2006 22:58:20 -0000 1.6
@@ -124,11 +124,9 @@
if (value) {
} else {
- char * msg = getResourceString(DBT_CGI_MISSING_ARGS);
- char * scratch = (char *) malloc(strlen(msg) + strlen(var) + 1);
- sprintf(scratch, msg, var);
+ char * scratch = PR_smprintf(getResourceString(DBT_CGI_MISSING_ARGS), var);
rpt_err(INCORRECT_USAGE, scratch, 0, 0);
- free((void *) scratch); /* never executed */
+ PR_smprintf_free(scratch); /* never executed */
}
return value;
@@ -182,7 +180,7 @@
* Returns 0 on success, -1 on failure.
*/
-int get_cert_nickname(char *buf) {
+int get_cert_nickname(char *buf, size_t bufsize) {
char *list_of_families;
char *family_name;
@@ -201,7 +199,7 @@
if((temp = get_cgi_var(cgi_var_name, "", "")) == NULL) {
return -1;
}
- strcpy(buf, temp);
+ PL_strncpyz(buf, temp, bufsize);
return 0;
/*family_name = PORT_Strtok(NULL, ",");*/
}
@@ -238,7 +236,7 @@
PR_snprintf(temp, sizeof(temp), "security=%s\n", val);
else
PR_snprintf(temp, sizeof(temp), "security=off\n");
- strcat(temp_return, temp);
+ PL_strcatn(temp_return, sizeof(temp_return), temp);
if((family_list = psetGetChildren(pset, "configuration.Encryption", &errorCode))) {
@@ -262,7 +260,7 @@
&errorCode);
if((!val) || (!token) || (!personality)) {
- strcat(temp_return, "familyList=NULL\n");
+ PL_strcatn(temp_return, sizeof(temp_return), "familyList=NULL\n");
*return_string = PORT_Strdup(temp_return);
return -1;
}
@@ -271,19 +269,19 @@
family_name++;
PR_snprintf(temp, sizeof(temp), "familyList=%s\n", family_name);
- strcat(temp_return, temp);
+ PL_strcatn(temp_return, sizeof(temp_return), temp);
PR_snprintf(temp, sizeof(temp), "%s-activated=%s\n", family_name, val);
- strcat(temp_return, temp);
+ PL_strcatn(temp_return, sizeof(temp_return), temp);
PR_snprintf(temp, sizeof(temp), "%s-token=%s\n", family_name, token);
- strcat(temp_return, temp);
+ PL_strcatn(temp_return, sizeof(temp_return), temp);
PR_snprintf(temp, sizeof(temp), "%s-cert=%s\n", family_name, personality);
- strcat(temp_return, temp);
+ PL_strcatn(temp_return, sizeof(temp_return), temp);
}
}
- strcat(temp_return, "familyList=NULL\n");
+ PL_strcatn(temp_return, sizeof(temp_return), "familyList=NULL\n");
/* get cipher preferences */
@@ -291,46 +289,46 @@
val = psetGetAttrSingleValue(pset,
"configuration.encryption.nsSSL2",
&errorCode);
- strcat(temp_return, "ssl2-activated=");
+ PL_strcatn(temp_return, sizeof(temp_return), "ssl2-activated=");
if(val)
- strcat(temp_return, val);
- strcat(temp_return, "\n");
+ PL_strcatn(temp_return, sizeof(temp_return), val);
+ PL_strcatn(temp_return, sizeof(temp_return), "\n");
val = NULL;
val = psetGetAttrSingleValue(pset,
"configuration.encryption.nsSSL2Ciphers",
&errorCode);
- strcat(temp_return, "ssl2=");
+ PL_strcatn(temp_return, sizeof(temp_return), "ssl2=");
if(val)
- strcat(temp_return, val);
- strcat(temp_return, "\n");
+ PL_strcatn(temp_return, sizeof(temp_return), val);
+ PL_strcatn(temp_return, sizeof(temp_return), "\n");
val = NULL;
val = psetGetAttrSingleValue(pset,
"configuration.encryption.nsSSL3",
&errorCode);
- strcat(temp_return, "ssl3-activated=");
+ PL_strcatn(temp_return, sizeof(temp_return), "ssl3-activated=");
if(val)
- strcat(temp_return, val);
- strcat(temp_return, "\n");
+ PL_strcatn(temp_return, sizeof(temp_return), val);
+ PL_strcatn(temp_return, sizeof(temp_return), "\n");
val = NULL;
val = psetGetAttrSingleValue(pset,
"configuration.encryption.nsSSL3Ciphers",
&errorCode);
- strcat(temp_return, "ssl3=");
+ PL_strcatn(temp_return, sizeof(temp_return), "ssl3=");
if(val)
- strcat(temp_return, val);
- strcat(temp_return, "\n");
+ PL_strcatn(temp_return, sizeof(temp_return), val);
+ PL_strcatn(temp_return, sizeof(temp_return), "\n");
val = NULL;
val = psetGetAttrSingleValue(pset,
"configuration.encryption.nsSSLClientAuth",
&errorCode);
- strcat(temp_return, "clientauth=");
+ PL_strcatn(temp_return, sizeof(temp_return), "clientauth=");
if(val)
- strcat(temp_return, val);
- strcat(temp_return, "\n");
+ PL_strcatn(temp_return, sizeof(temp_return), val);
+ PL_strcatn(temp_return, sizeof(temp_return), "\n");
*return_string = PORT_Strdup(temp_return);
return 0;
@@ -609,7 +607,7 @@
/* get all variables */
rv = GetSSLFamilyAttributes(pset, &return_string);
- fprintf(stdout, return_string);
+ fputs(return_string, stdout);
free(return_string);
}
else if (!PORT_Strcmp(method, "POST")) {
@@ -631,11 +629,9 @@
get_family_input(&family_head);
if((trustdb = get_cgi_var(trustdbVN, "", "")) == NULL) {
- char * msg = getResourceString(DBT_CGI_MISSING_ARGS);
- char * scratch = (char *) malloc(strlen(msg) + sizeof(trustdbVN));
- sprintf(scratch, msg, trustdbVN);
+ char * scratch = PR_smprintf(getResourceString(DBT_CGI_MISSING_ARGS), trustdbVN);
rpt_err(ELEM_MISSING, NULL, scratch, NULL);
- free((void *) scratch); /* never executed */
+ PR_smprintf_free(scratch); /* never executed */
}
/* SET SSL VARIABLES via pset */
@@ -666,12 +662,10 @@
char protocols[BIG_LINE];
char ciphers[BIG_LINE];
- if (get_cert_nickname(certnickname) < 0) {
- char * msg = getResourceString(DBT_CGI_MISSING_ARGS);
- char * scratch = (char *) malloc(strlen(msg) + strlen(certnickname) + 1);
- sprintf(scratch, msg, certnickname);
+ if (get_cert_nickname(certnickname, sizeof(certnickname)) < 0) {
+ char * scratch = PR_smprintf(getResourceString(DBT_CGI_MISSING_ARGS), certnickname);
rpt_err(ELEM_MISSING, NULL, scratch, NULL);
- free((void *) scratch); /* never executed */
+ PR_smprintf_free(scratch); /* never executed */
}
if (strlen(clientauth) == 0) {
clientauth = (char*)"off";
@@ -689,7 +683,8 @@
rv = update_conf("console.conf", "NSSProtocol", protocols);
- snprintf(ciphers, BIG_LINE, "%s,%s", ssl2, ssl3);
+ snprintf(ciphers, sizeof(ciphers), "%s,%s", ssl2, ssl3);
+ ciphers[sizeof(ciphers)-1] = 0;
rv = update_conf("console.conf", "NSSCipherSuite", ciphers);
if (!strcmp(clientauth, "on"))
Index: security.c
===================================================================
RCS file: /cvs/dirsec/adminserver/admserv/cgi-src40/security.c,v
retrieving revision 1.6
retrieving revision 1.7
diff -u -r1.6 -r1.7
--- security.c 1 Feb 2006 23:03:57 -0000 1.6
+++ security.c 31 Mar 2006 22:58:20 -0000 1.7
@@ -1010,10 +1010,12 @@
loser:
if (privateKey==NULL) {
- char tmpLine[BIG_LINE];
+ char *tmpLine = NULL;
+ tmpLine = (char *)PR_Malloc(PR_GetErrorTextLength()+1);
PR_GetErrorText(tmpLine);
PR_snprintf(line, sizeof(line), "%d:%s", PR_GetError(), tmpLine);
+ PR_Free(tmpLine);
rpt_err(GENERAL_FAILURE,
getResourceString(DBT_INTERNAL_ERROR),
@@ -1231,9 +1233,12 @@
if (rv != SECSuccess) {
{
- char tmpLine[BIG_LINE];
+ char *tmpLine;
+
+ tmpLine = (char *)PR_Malloc(PR_GetErrorTextLength()+1);
PR_GetErrorText(tmpLine);
PR_snprintf(line, sizeof(line), "%d:%s", PR_GetError(), tmpLine);
+ PR_Free(tmpLine);
}
/* if unable to import report error */
rpt_err(SYSTEM_ERROR,
Index: snmpconf.c
===================================================================
RCS file: /cvs/dirsec/adminserver/admserv/cgi-src40/snmpconf.c,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -r1.4 -r1.5
--- snmpconf.c 18 Aug 2005 18:59:03 -0000 1.4
+++ snmpconf.c 31 Mar 2006 22:58:20 -0000 1.5
@@ -115,8 +115,8 @@
char resPath[256], *execPath;
execPath = getcwd(resPath, 256);
if (execPath) {
- strcpy(resPath, execPath);
- strcat(resPath, "/property");
+ PL_strncpyz(resPath, execPath, sizeof(resPath));
+ PL_strcatn(resPath, sizeof(resPath), "/property");
i18nResource = res_init_resource(resPath, RESOURCE_FILE);
}
if (getenv("HTTP_ACCEPT_LANGUAGE")) {
@@ -396,7 +396,6 @@
void update_manager_list(char *manager, char *configfile) {
char *comma, *tab1, *tab2, *entry, *name, *trap_port, *community;
- char op_buf[128];
manager_list * list = NULL;
Index: snmpmctl.c
===================================================================
RCS file: /cvs/dirsec/adminserver/admserv/cgi-src40/snmpmctl.c,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -r1.4 -r1.5
--- snmpmctl.c 18 Aug 2005 18:59:03 -0000 1.4
+++ snmpmctl.c 31 Mar 2006 22:58:20 -0000 1.5
@@ -133,8 +133,8 @@
char resPath[256], *execPath;
execPath = getcwd(resPath, 256);
if (execPath) {
- strcpy(resPath, execPath);
- strcat(resPath, "/property");
+ PL_strncpyz(resPath, execPath, sizeof(resPath));
+ PL_strcatn(resPath, sizeof(resPath), "/property");
i18nResource = res_init_resource(resPath, RESOURCE_FILE);
}
if (getenv("HTTP_ACCEPT_LANGUAGE")) {
@@ -162,7 +162,6 @@
int main(int argc, char *argv[])
{
int _ai = ADMUTIL_Init();
- char line[BIG_LINE];
char *method = getenv("REQUEST_METHOD");
char *qs=0;
char *root = getenv("NETSITE_ROOT");
@@ -410,7 +409,6 @@
char command[BIG_LINE];
char path[PATH_MAX];
FILE *fhdl;
- char buffer[20];
char *ADMSERV_ROOT = getenv("ADMSERV_ROOT");
pid_t magtid;
@@ -524,7 +522,6 @@
char errlog[PATH_MAX];
FILE *fhdl;
pid_t magtid;
- char buffer[20];
char err_text[128];
int ret=0;
Index: start_config_ds.c
===================================================================
RCS file: /cvs/dirsec/adminserver/admserv/cgi-src40/start_config_ds.c,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -r1.4 -r1.5
--- start_config_ds.c 18 Aug 2005 18:59:03 -0000 1.4
+++ start_config_ds.c 31 Mar 2006 22:58:20 -0000 1.5
@@ -112,6 +112,7 @@
return error_exit("NETSITE_ROOT not found");
snprintf(path, sizeof(path), "%s%c%s", admroot, FILE_SEP, ADMIN_CONFIG_FILE);
+ path[sizeof(path)-1] = 0;
if (!(configfile = fopen(path, "r")))
return error_exit("Failed to open adm.conf");
@@ -137,6 +138,7 @@
p++;
snprintf(path, sizeof(path), "%s%c%s", srvroot, FILE_SEP, p);
+ path[sizeof(path)-1] = 0;
/* this should probably be an explicit fork/exec, but I don't have the time... */
if ((ret_val = system(path)) == -1)
Index: statpingserv.c
===================================================================
RCS file: /cvs/dirsec/adminserver/admserv/cgi-src40/statpingserv.c,v
retrieving revision 1.3
retrieving revision 1.4
diff -u -r1.3 -r1.4
--- statpingserv.c 18 Aug 2005 18:59:03 -0000 1.3
+++ statpingserv.c 31 Mar 2006 22:58:20 -0000 1.4
@@ -57,7 +57,6 @@
{
int _ai = ADMUTIL_Init();
char *m;
- char msg[BIG_LINE];
char *qs = getenv("QUERY_STRING");
PRHostEnt hent;
Index: stopsrv.c
===================================================================
RCS file: /cvs/dirsec/adminserver/admserv/cgi-src40/stopsrv.c,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -r1.4 -r1.5
--- stopsrv.c 18 Aug 2005 18:59:03 -0000 1.4
+++ stopsrv.c 31 Mar 2006 22:58:20 -0000 1.5
@@ -81,8 +81,8 @@
execPath = getcwd(resPath, 256);
if (execPath) {
- strcpy(resPath, execPath);
- strcat(resPath, "/property");
+ PL_strncpyz(resPath, execPath, sizeof(resPath));
+ PL_strcatn(resPath, sizeof(resPath), "/property");
i18nResource = res_init_resource(resPath, RESOURCE_FILE);
}
Index: ugdsconfig.c
===================================================================
RCS file: /cvs/dirsec/adminserver/admserv/cgi-src40/ugdsconfig.c,v
retrieving revision 1.5
retrieving revision 1.6
diff -u -r1.5 -r1.6
--- ugdsconfig.c 28 Oct 2005 22:43:29 -0000 1.5
+++ ugdsconfig.c 31 Mar 2006 22:58:20 -0000 1.6
@@ -137,8 +137,8 @@
char resPath[256], *execPath;
execPath = getcwd(resPath, 256);
if (execPath) {
- strcpy(resPath, execPath);
- strcat(resPath, "/property");
+ PL_strncpyz(resPath, execPath, sizeof(resPath));
+ PL_strcatn(resPath, sizeof(resPath), "/property");
i18nResource = res_init_resource(resPath, RESOURCE_FILE);
}
if (getenv("HTTP_ACCEPT_LANGUAGE")) {
Index: userinfo.c
===================================================================
RCS file: /cvs/dirsec/adminserver/admserv/cgi-src40/userinfo.c,v
retrieving revision 1.3
retrieving revision 1.4
diff -u -r1.3 -r1.4
--- userinfo.c 18 Aug 2005 18:59:03 -0000 1.3
+++ userinfo.c 31 Mar 2006 22:58:20 -0000 1.4
@@ -34,7 +34,6 @@
{
int _ai = ADMUTIL_Init();
AdmldapInfo ldapInfo;
- char admconf[256];
char *method;
int rv, rv1, rv2;
int err;
Index: viewdata.c
===================================================================
RCS file: /cvs/dirsec/adminserver/admserv/cgi-src40/viewdata.c,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -r1.4 -r1.5
--- viewdata.c 18 Aug 2005 18:59:03 -0000 1.4
+++ viewdata.c 31 Mar 2006 22:58:20 -0000 1.5
@@ -95,8 +95,8 @@
char resPath[256], *execPath;
execPath = getcwd(resPath, 256);
if (execPath) {
- strcpy(resPath, execPath);
- strcat(resPath, "/property");
+ PL_strncpyz(resPath, execPath, sizeof(resPath));
+ PL_strcatn(resPath, sizeof(resPath), "/property");
i18nResource = res_init_resource(resPath, RESOURCE_FILE);
}
if (getenv("HTTP_ACCEPT_LANGUAGE")) {
@@ -222,6 +222,7 @@
char *dn;
char *domain;
char *tmp, *tmp2;
+ char *base = NULL;
LDAPMessage *entry;
int ldapError;
@@ -243,39 +244,28 @@
/* form the rest of the url */
- if(strstr(sie, "Messaging")) {
- dn = (char *)malloc(strlen("ou=Messaging, ou=Global Preferences, ") + strlen(domain) + 1);
- sprintf(dn, "ou=Messaging, ou=Global Preferences, %s", domain);
- }
- else if(strstr(sie, "Administration")) {
- dn = (char *)malloc(strlen("ou=Admin, ou=Global Preferences, ") + strlen(domain) + 1);
- sprintf(dn, "ou=Admin, ou=Global Preferences, %s", domain);
+ if(strstr(sie, "Administration")) {
+ base = "ou=Admin, ou=Global Preferences";
}
else if(strstr(sie, "Directory")) {
- dn = (char *)malloc(strlen("ou=Directory, ou=Global Preferences, ") + strlen(domain) + 1);
- sprintf(dn, "ou=Directory, ou=Global Preferences, %s", domain);
+ base = "ou=Directory, ou=Global Preferences";
}
else if(strstr(sie, "Enterprise")) {
- dn = (char *)malloc(strlen("ou=Enterprise, ou=Global Preferences, ") + strlen(domain) + 1);
- sprintf(dn, "ou=Enterprise, ou=Global Preferences, %s", domain);
+ base = "ou=Enterprise, ou=Global Preferences";
}
else if(strstr(sie, "Certificate")) {
- dn = (char *)malloc(strlen("ou=Certificate, ou=Global Preferences, ") + strlen(domain) + 1);
- sprintf(dn, "ou=Certificate, ou=Global Preferences, %s", domain);
- }
- else if(strstr(sie, "Application")) {
- dn = (char *)malloc(strlen("ou=Application, ou=Global Preferences, ") + strlen(domain) + 1);
- sprintf(dn, "ou=Application, ou=Global Preferences, %s", domain);
- }
- else if(strstr(sie, "Biller")) {
- dn = (char *)malloc(strlen("ou=Biller, ou=Global Preferences, ") + strlen(domain) + 1);
- sprintf(dn, "ou=Biller, ou=Global Preferences, %s", domain);
+ base = "ou=Certificate, ou=Global Preferences";
}
+ dn = PR_smprintf("%s, %s", base, domain);
+
if((ldapError = ldap_search_s(server, dn, LDAP_SCOPE_BASE,
- "(objectclass=*)", NULL, 0, &entry)) != LDAP_SUCCESS)
+ "(objectclass=*)", NULL, 0, &entry)) != LDAP_SUCCESS) {
+ PR_smprintf_free(dn);
return 1;
+ }
+ PR_smprintf_free(dn);
if(vals = ldap_get_values(server, entry, "nshtmladminproducturl")) {
*url = strdup(vals[0]);
ldap_value_free(vals);
@@ -329,7 +319,7 @@
tzset();
PR_snprintf(buf, sizeof(buf), "%s %s", buf, daylight ? tzname[1] : tzname[0]);
#else
- strftime(buf, BIG_LINE, "%b %d, %Y %T %p %Z", &tm);
+ strftime(buf, sizeof(buf), "%b %d, %Y %T %p %Z", &tm);
#endif
@@ -346,15 +336,16 @@
if(!(vals = ldap_get_values(server, entry, "nsserverport"))) {
/* argh, port can be in the configuration object */
- char *config_buf = (char *)malloc(strlen("cn=configuration, ") + strlen(sie) + 1);
- sprintf(config_buf, "cn=configuration, %s", sie);
+ char *config_buf = PR_smprintf("cn=configuration, %s", sie);
if((ldapError = ldap_search_s(server, config_buf, LDAP_SCOPE_BASE,
- "(objectclass=*)", NULL, 0, &entry)) != LDAP_SUCCESS)
+ "(objectclass=*)", NULL, 0, &entry)) != LDAP_SUCCESS) {
+ PR_smprintf_free(config_buf);
return;
+ }
+ PR_smprintf_free(config_buf);
vals = ldap_get_values(server, entry, "nsserverport");
- free(config_buf);
}
if(vals) {
fprintf(stdout, (const char*)getResourceString(DBT_OUTPUT_DATA_SERVER_PORT), vals[0]);
@@ -499,15 +490,12 @@
nbuf = (bufstruct *) new_buffer(NBUF_SIZE);
- request = (char *)malloc(strlen(getResourceString(DBT_NETCENTER_GET_REQ)) +
- strlen((char *)binddn) +
- 3); /* space + 2 newline characters */
-
- sprintf(request, getResourceString(DBT_NETCENTER_GET_REQ), binddn);
+ request = PR_smprintf(getResourceString(DBT_NETCENTER_GET_REQ), binddn);
sockd = make_http_request("http",
getResourceString(DBT_NETCENTER_HOST),
atoi(getResourceString(DBT_NETCENTER_PORT)),
request, 60, &errorcode);
+ PR_smprintf_free(request);
if (sockd == NULL) {
continue;
Index: viewlog.c
===================================================================
RCS file: /cvs/dirsec/adminserver/admserv/cgi-src40/viewlog.c,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -r1.4 -r1.5
--- viewlog.c 18 Aug 2005 18:59:03 -0000 1.4
+++ viewlog.c 31 Mar 2006 22:58:20 -0000 1.5
@@ -86,7 +86,7 @@
replace=0;
count=0;
- while(fgets(line, BIG_LINE, cmd)) {
+ while(fgets(line, sizeof(line), cmd)) {
if(strncmp(line, "format=", 7))
if((!str) || (strstr(line, str))) {
count++;
@@ -129,8 +129,8 @@
char resPath[256], *execPath;
execPath = getcwd(resPath, 256);
if (execPath) {
- strcpy(resPath, execPath);
- strcat(resPath, "/property");
+ PL_strncpyz(resPath, execPath, sizeof(resPath));
+ PL_strcatn(resPath, sizeof(resPath), "/property");
i18nResource = res_init_resource(resPath, RESOURCE_FILE);
}
if (getenv("HTTP_ACCEPT_LANGUAGE")) {
@@ -163,7 +163,7 @@
}
fprintf(stdout, getResourceString(DBT_DISPLAY_LOGFILE_SELECT_BEGIN));
- strcpy(temp_dirs, dirs);
+ PL_strncpyz(temp_dirs, dirs, sizeof(temp_dirs));
current_dir = strtok(temp_dirs, "|");
while(current_dir) {
@@ -226,7 +226,7 @@
if(!file)
return NULL;
- strcpy(temp, directories);
+ PL_strncpyz(temp, directories, sizeof(temp));
ptr = strtok(temp, "|");
while(ptr != NULL) {
@@ -374,7 +374,6 @@
char *file;
char *directories;
char *id;
- char log_dir[PATH_MAX];
char **logfiles = NULL;
char tmp[BIG_LINE];
int x;
