[PATCH] vsprintf -> vsnprintf conversions

Convert all instances of un-checked vsprintf calls into vsnprintf. Most
functions switched to MAX_PRINTMSG length buffers instead of 1024. This means
we now silently truncate messages, rather than crashing (preferrably, I
think). This patch is based on some changes proposed by Ozkan.

Signed-off-by: Tyrann <tyrann@disenchant.net>
This commit is contained in:
Tyrann 2006-10-07 19:05:47 +09:30
parent b77e04a80c
commit 138145c9bd
15 changed files with 49 additions and 64 deletions

View File

@ -109,10 +109,10 @@ void
Host_EndGame(char *message, ...)
{
va_list argptr;
char string[1024];
char string[MAX_PRINTMSG];
va_start(argptr, message);
vsprintf(string, message, argptr);
vsnprintf(string, sizeof(string), message, argptr);
va_end(argptr);
Con_DPrintf("%s: %s\n", __func__, string);
@ -141,7 +141,7 @@ void
Host_Error(char *error, ...)
{
va_list argptr;
char string[1024];
char string[MAX_PRINTMSG];
static qboolean inerror = false;
if (inerror)
@ -151,7 +151,7 @@ Host_Error(char *error, ...)
SCR_EndLoadingPlaque(); // reenable screen updates
va_start(argptr, error);
vsprintf(string, error, argptr);
vsnprintf(string, sizeof(string), error, argptr);
va_end(argptr);
Con_Printf("%s: %s\n", __func__, string);
@ -299,10 +299,10 @@ void
SV_ClientPrintf(char *fmt, ...)
{
va_list argptr;
char string[1024];
char string[MAX_PRINTMSG];
va_start(argptr, fmt);
vsprintf(string, fmt, argptr);
vsnprintf(string, sizeof(string), fmt, argptr);
va_end(argptr);
MSG_WriteByte(&host_client->message, svc_print);
@ -320,11 +320,11 @@ void
SV_BroadcastPrintf(char *fmt, ...)
{
va_list argptr;
char string[1024];
char string[MAX_PRINTMSG];
int i;
va_start(argptr, fmt);
vsprintf(string, fmt, argptr);
vsnprintf(string, sizeof(string), fmt, argptr);
va_end(argptr);
for (i = 0; i < svs.maxclients; i++)
@ -345,10 +345,10 @@ void
Host_ClientCommands(char *fmt, ...)
{
va_list argptr;
char string[1024];
char string[MAX_PRINTMSG];
va_start(argptr, fmt);
vsprintf(string, fmt, argptr);
vsnprintf(string, sizeof(string), fmt, argptr);
va_end(argptr);
MSG_WriteByte(&host_client->message, svc_stufftext);

View File

@ -253,10 +253,10 @@ void
PR_RunError(char *error, ...)
{
va_list argptr;
char string[1024];
char string[MAX_PRINTMSG];
va_start(argptr, error);
vsprintf(string, error, argptr);
vsnprintf(string, sizeof(string), error, argptr);
va_end(argptr);
PR_PrintStatement(pr_statements + pr_xstatement);

View File

@ -62,16 +62,11 @@ Sys_Printf(char *fmt, ...)
va_list argptr;
char text[MAX_PRINTMSG];
unsigned char *p;
int cnt;
va_start(argptr, fmt);
cnt = vsnprintf(text, sizeof(text) - 1, fmt, argptr);
vsnprintf(text, sizeof(text) - 1, fmt, argptr);
va_end(argptr);
// FIXME - require glibc >= 2.1 for C99 standard return value
if (cnt >= sizeof(text))
Sys_Error("memory overwrite in Sys_Printf");
if (nostdout)
return;
@ -126,7 +121,7 @@ Sys_Error(char *error, ...)
fcntl(STDIN_FILENO, F_GETFL, 0) & ~O_NONBLOCK);
va_start(argptr, error);
vsprintf(string, error, argptr);
vsnprintf(string, sizeof(string), error, argptr);
va_end(argptr);
fprintf(stderr, "Error: %s\n", string);
@ -225,7 +220,7 @@ Sys_DebugLog(char *file, char *fmt, ...)
int fd;
va_start(argptr, fmt);
vsprintf(data, fmt, argptr);
vsnprintf(data, sizeof(data), fmt, argptr);
va_end(argptr);
// fd = open(file, O_WRONLY | O_BINARY | O_CREAT | O_APPEND, 0666);
fd = open(file, O_WRONLY | O_CREAT | O_APPEND, 0666);

View File

@ -77,7 +77,7 @@ Sys_DebugLog(char *file, char *fmt, ...)
int fd;
va_start(argptr, fmt);
vsprintf(data, fmt, argptr);
vsnprintf(data, sizeof(data), fmt, argptr);
va_end(argptr);
fd = open(file, O_WRONLY | O_CREAT | O_APPEND, 0666);
write(fd, data, strlen(data));
@ -395,12 +395,12 @@ Sys_Error(char *error, ...)
}
va_start(argptr, error);
vsprintf(text, error, argptr);
vsnprintf(text, sizeof(error), error, argptr);
va_end(argptr);
if (isDedicated) {
va_start(argptr, error);
vsprintf(text, error, argptr);
vsnprintf(text, sizeof(text), error, argptr);
va_end(argptr);
sprintf(text2, "ERROR: %s\n", text);
@ -452,7 +452,7 @@ Sys_Printf(char *fmt, ...)
if (isDedicated) {
va_start(argptr, fmt);
vsprintf(text, fmt, argptr);
vsnprintf(text, sizeof(text), fmt, argptr);
va_end(argptr);
WriteFile(houtput, text, strlen(text), &dummy, NULL);

View File

@ -1214,10 +1214,10 @@ void
Host_EndGame(char *message, ...)
{
va_list argptr;
char string[1024];
char string[MAX_PRINTMSG];
va_start(argptr, message);
vsprintf(string, message, argptr);
vsnprintf(string, sizeof(string), message, argptr);
va_end(argptr);
Con_Printf("\n===========================\n");
Con_Printf("Host_EndGame: %s\n", string);
@ -1239,7 +1239,7 @@ void
Host_Error(char *error, ...)
{
va_list argptr;
char string[1024];
char string[MAX_PRINTMSG];
static qboolean inerror = false;
if (inerror)
@ -1247,7 +1247,7 @@ Host_Error(char *error, ...)
inerror = true;
va_start(argptr, error);
vsprintf(string, error, argptr);
vsnprintf(string, sizeof(string), error, argptr);
va_end(argptr);
Con_Printf("Host_Error: %s\n", string);

View File

@ -55,16 +55,11 @@ Sys_Printf(char *fmt, ...)
va_list argptr;
char text[MAX_PRINTMSG];
unsigned char *p;
int cnt;
va_start(argptr, fmt);
cnt = vsnprintf(text, sizeof(text) - 1, fmt, argptr);
vsnprintf(text, sizeof(text) - 1, fmt, argptr);
va_end(argptr);
// FIXME - require glibc >= 2.1 for C99 standard return value
if (cnt >= sizeof(text))
Sys_Error("memory overwrite in Sys_Printf");
if (nostdout)
return;
@ -105,7 +100,7 @@ Sys_Error(char *error, ...)
fcntl(STDIN_FILENO, F_GETFL, 0) & ~O_NONBLOCK);
va_start(argptr, error);
vsprintf(string, error, argptr);
vsnprintf(string, sizeof(string), error, argptr);
va_end(argptr);
fprintf(stderr, "Error: %s\n", string);
@ -204,7 +199,7 @@ Sys_DebugLog(char *file, char *fmt, ...)
int fd;
va_start(argptr, fmt);
vsprintf(data, fmt, argptr);
vsnprintf(data, sizeof(data), fmt, argptr);
va_end(argptr);
fd = open(file, O_WRONLY | O_CREAT | O_APPEND, 0666);
write(fd, data, strlen(data));

View File

@ -66,7 +66,7 @@ Sys_DebugLog(char *file, char *fmt, ...)
int fd;
va_start(argptr, fmt);
vsprintf(data, fmt, argptr);
vsnprintf(data, sizeof(data), fmt, argptr);
va_end(argptr);
fd = open(file, O_WRONLY | O_CREAT | O_APPEND, 0666);
write(fd, data, strlen(data));
@ -237,7 +237,7 @@ Sys_Error(char *error, ...)
Host_Shutdown();
va_start(argptr, error);
vsprintf(text, error, argptr);
vsnprintf(text, sizeof(text), error, argptr);
va_end(argptr);
MessageBox(NULL, text, "Error", 0 /* MB_OK */ );

View File

@ -151,7 +151,7 @@ Netchan_OutOfBandPrint(netadr_t adr, char *format, ...)
static char string[8192]; /* FIXME - ??? why static? - stack probs? */
va_start(argptr, format);
vsprintf(string, format, argptr);
vsnprintf(string, sizeof(string), format, argptr);
va_end(argptr);
Netchan_OutOfBand(adr, strlen(string), (byte *)string);

View File

@ -254,10 +254,10 @@ void
PR_RunError(char *error, ...)
{
va_list argptr;
char string[1024];
char string[MAX_PRINTMSG];
va_start(argptr, error);
vsprintf(string, error, argptr);
vsnprintf(string, sizeof(string), error, argptr);
va_end(argptr);
PR_PrintStatement(pr_statements + pr_xstatement);

View File

@ -129,7 +129,7 @@ void
SV_Error(char *error, ...)
{
va_list argptr;
static char string[1024];
static char string[MAX_PRINTMSG];
static qboolean inerror = false;
if (inerror)
@ -138,7 +138,7 @@ SV_Error(char *error, ...)
inerror = true;
va_start(argptr, error);
vsprintf(string, error, argptr);
vsnprintf(string, sizeof(string), error, argptr);
va_end(argptr);
Con_Printf("%s: %s\n", __func__, string);

View File

@ -105,7 +105,6 @@ Con_Printf
Handles cursor positioning, line wrapping, etc
================
*/
// FIXME: make a buffer size safe vsprintf?
void
Con_Printf(char *fmt, ...)
{
@ -113,7 +112,7 @@ Con_Printf(char *fmt, ...)
char msg[MAX_PRINTMSG];
va_start(argptr, fmt);
vsprintf(msg, fmt, argptr);
vsnprintf(msg, sizeof(msg), fmt, argptr);
va_end(argptr);
// add to redirected message
@ -146,7 +145,7 @@ Con_DPrintf(char *fmt, ...)
return;
va_start(argptr, fmt);
vsprintf(msg, fmt, argptr);
vsnprintf(msg, sizeof(msg), fmt, argptr);
va_end(argptr);
Con_Printf("%s", msg);
@ -180,13 +179,13 @@ void
SV_ClientPrintf(client_t *cl, int level, char *fmt, ...)
{
va_list argptr;
char string[1024];
char string[MAX_PRINTMSG];
if (level < cl->messagelevel)
return;
va_start(argptr, fmt);
vsprintf(string, fmt, argptr);
vsnprintf(string, sizeof(string), fmt, argptr);
va_end(argptr);
SV_PrintToClient(cl, level, string);
@ -203,12 +202,12 @@ void
SV_BroadcastPrintf(int level, char *fmt, ...)
{
va_list argptr;
char string[1024];
char string[MAX_PRINTMSG];
client_t *cl;
int i;
va_start(argptr, fmt);
vsprintf(string, fmt, argptr);
vsnprintf(string, sizeof(string), fmt, argptr);
va_end(argptr);
Sys_Printf("%s", string); // print to the console
@ -234,12 +233,12 @@ void
SV_BroadcastCommand(char *fmt, ...)
{
va_list argptr;
char string[1024];
char string[MAX_PRINTMSG];
if (!sv.state)
return;
va_start(argptr, fmt);
vsprintf(string, fmt, argptr);
vsnprintf(string, sizeof(string), fmt, argptr);
va_end(argptr);
MSG_WriteByte(&sv.reliable_datagram, svc_stufftext);

View File

@ -551,7 +551,7 @@ void
OutofBandPrintf(netadr_t where, char *fmt, ...)
{
va_list argptr;
char send[1024];
char send[MAX_PRINTMSG];
send[0] = 0xff;
send[1] = 0xff;
@ -559,7 +559,7 @@ OutofBandPrintf(netadr_t where, char *fmt, ...)
send[3] = 0xff;
send[4] = A2C_PRINT;
va_start(argptr, fmt);
vsprintf(send + 5, fmt, argptr);
vsnprintf(send + 5, sizeof(send) - 5, fmt, argptr);
va_end(argptr);
NET_SendPacket(strlen(send) + 1, send, where);

View File

@ -115,7 +115,7 @@ Sys_Error(char *error, ...)
char string[MAX_PRINTMSG];
va_start(argptr, error);
vsprintf(string, error, argptr);
vsnprintf(string, sizeof(string), error, argptr);
va_end(argptr);
printf("Fatal error: %s\n", string);
@ -135,12 +135,9 @@ Sys_Printf(char *fmt, ...)
unsigned char *p;
va_start(argptr, fmt);
vsprintf(text, fmt, argptr);
vsnprintf(text, sizeof(text), fmt, argptr);
va_end(argptr);
if (strlen(text) > sizeof(text))
Sys_Error("memory overwrite in Sys_Printf");
if (sys_nostdout.value)
return;

View File

@ -73,7 +73,7 @@ Sys_Error(char *error, ...)
char text[MAX_PRINTMSG];
va_start(argptr, error);
vsprintf(text, error, argptr);
vsnprintf(text, sizeof(text), error, argptr);
va_end(argptr);
// MessageBox(NULL, text, "Error", 0 /* MB_OK */ );

View File

@ -304,7 +304,6 @@ Con_Printf
Handles cursor positioning, line wrapping, etc
================
*/
// FIXME: make a buffer size safe vsprintf?
void
Con_Printf(char *fmt, ...)
{
@ -313,7 +312,7 @@ Con_Printf(char *fmt, ...)
static qboolean inupdate;
va_start(argptr, fmt);
vsprintf(msg, fmt, argptr);
vsnprintf(msg, sizeof(msg), fmt, argptr);
va_end(argptr);
// also echo to debugging console
@ -375,7 +374,7 @@ Con_DPrintf(char *fmt, ...)
return; // don't confuse non-developers with techie stuff...
va_start(argptr, fmt);
vsprintf(msg, fmt, argptr);
vsnprintf(msg, sizeof(msg), fmt, argptr);
va_end(argptr);
Con_Printf("%s", msg);
@ -657,7 +656,7 @@ Con_SafePrintf(char *fmt, ...)
int temp;
va_start(argptr, fmt);
vsprintf(msg, fmt, argptr);
vsnprintf(msg, sizeof(msg), fmt, argptr);
va_end(argptr);
temp = scr_disabled_for_loading;