Fixed: all possible malloc, sprintf and strcpy problems

Signed-off-by: Alexander Wenzel <Alexander.AW.Wenzel@bmw.de>

4 files changed, 102 insertions, 58 deletions

diff --git a/src/daemon/dlt-daemon.c b/src/daemon/dlt-daemon.c
index 8f4d9de..38f08c6 100644
--- a/src/daemon/dlt-daemon.c
+++ b/src/daemon/dlt-daemon.c
@@ -75,7 +75,7 @@ static char str[DLT_DAEMON_TEXTBUFSIZE];
 void usage()
 {
 	char version[DLT_DAEMON_TEXTBUFSIZE];
-	dlt_get_version(version);
+	dlt_get_version(version,DLT_DAEMON_TEXTBUFSIZE);
 
     //printf("DLT logging daemon %s %s\n", _DLT_PACKAGE_VERSION, _DLT_PACKAGE_VERSION_STATE);
     //printf("Compile options: %s %s %s %s",_DLT_SYSTEMD_ENABLE, _DLT_SYSTEMD_WATCHDOG_ENABLE, _DLT_TEST_ENABLE, _DLT_SHM_ENABLE);
@@ -175,7 +175,8 @@ int option_file_parser(DltDaemonLocal *daemon_local)
 	daemon_local->flags.offlineTraceMaxSize = 0;
 	daemon_local->flags.loggingMode = 0;
 	daemon_local->flags.loggingLevel = 6;
-	strncpy(daemon_local->flags.loggingFilename, DLT_USER_DIR "/dlt.log",sizeof(daemon_local->flags.loggingFilename));
+	strncpy(daemon_local->flags.loggingFilename, DLT_USER_DIR "/dlt.log",sizeof(daemon_local->flags.loggingFilename)-1);
+	daemon_local->flags.loggingFilename[sizeof(daemon_local->flags.loggingFilename)-1]=0;
 	daemon_local->timeoutOnSend = 4;
 	daemon_local->flags.sendECUSoftwareVersion = 0;
 	memset(daemon_local->flags.pathToECUSoftwareVersion, 0, sizeof(daemon_local->flags.pathToECUSoftwareVersion));
@@ -207,11 +208,13 @@ int option_file_parser(DltDaemonLocal *daemon_local)
 
 					if(token[0]==0)
 					{
-                                                strncpy(token,pch,sizeof(token) - 1);
+                        strncpy(token,pch,sizeof(token) - 1);
+                        token[sizeof(token) - 1]=0;
 					}
 					else
 					{
-                                                strncpy(value,pch,sizeof(value) - 1);
+                        strncpy(value,pch,sizeof(value) - 1);
+                        value[sizeof(value) - 1]=0;
 						break;
 					}
 
@@ -268,22 +271,26 @@ int option_file_parser(DltDaemonLocal *daemon_local)
 						}
 						else if(strcmp(token,"RS232DeviceName")==0)
 						{
-                                                        strncpy(daemon_local->flags.yvalue,value,NAME_MAX);
+                            strncpy(daemon_local->flags.yvalue,value,NAME_MAX);
+                            daemon_local->flags.yvalue[NAME_MAX]=0;
 							//printf("Option: %s=%s\n",token,value);
 						}
 						else if(strcmp(token,"RS232Baudrate")==0)
 						{
-                                                        strncpy(daemon_local->flags.bvalue,value,NAME_MAX);
+                            strncpy(daemon_local->flags.bvalue,value,NAME_MAX);
+                            daemon_local->flags.bvalue[NAME_MAX]=0;
 							//printf("Option: %s=%s\n",token,value);
 						}
 						else if(strcmp(token,"ECUId")==0)
 						{
-                                                        strncpy(daemon_local->flags.evalue,value,NAME_MAX);
+                            strncpy(daemon_local->flags.evalue,value,NAME_MAX);
+                            daemon_local->flags.evalue[NAME_MAX]=0;
 							//printf("Option: %s=%s\n",token,value);
 						}
 						else if(strcmp(token,"PersistanceStoragePath")==0)
 						{
-                                                        strncpy(daemon_local->flags.ivalue,value,NAME_MAX);
+                            strncpy(daemon_local->flags.ivalue,value,NAME_MAX);
+                            daemon_local->flags.ivalue[NAME_MAX]=0;
 							//printf("Option: %s=%s\n",token,value);
 						}
 						else if(strcmp(token,"LoggingMode")==0)
@@ -298,7 +305,8 @@ int option_file_parser(DltDaemonLocal *daemon_local)
 						}
 						else if(strcmp(token,"LoggingFilename")==0)
 						{
-                                                        strncpy(daemon_local->flags.loggingFilename,value,sizeof(daemon_local->flags.loggingFilename) - 1);
+                            strncpy(daemon_local->flags.loggingFilename,value,sizeof(daemon_local->flags.loggingFilename) - 1);
+                            daemon_local->flags.loggingFilename[sizeof(daemon_local->flags.loggingFilename) - 1]=0;
 							//printf("Option: %s=%s\n",token,value);
 						}
                        	else if(strcmp(token,"TimeOutOnSend")==0)
@@ -313,7 +321,8 @@ int option_file_parser(DltDaemonLocal *daemon_local)
 						}
 						else if(strcmp(token,"OfflineTraceDirectory")==0)
 						{
-                                                        strncpy(daemon_local->flags.offlineTraceDirectory,value,sizeof(daemon_local->flags.offlineTraceDirectory) - 1);
+                            strncpy(daemon_local->flags.offlineTraceDirectory,value,sizeof(daemon_local->flags.offlineTraceDirectory) - 1);
+                            daemon_local->flags.offlineTraceDirectory[sizeof(daemon_local->flags.offlineTraceDirectory) - 1]=0;
 							//printf("Option: %s=%s\n",token,value);
 						}
 						else if(strcmp(token,"OfflineTraceFileSize")==0)
@@ -333,7 +342,8 @@ int option_file_parser(DltDaemonLocal *daemon_local)
 						}
 						else if(strcmp(token,"PathToECUSoftwareVersion")==0)
 						{
-                                                        strncpy(daemon_local->flags.pathToECUSoftwareVersion,value,sizeof(daemon_local->flags.pathToECUSoftwareVersion) - 1);
+                            strncpy(daemon_local->flags.pathToECUSoftwareVersion,value,sizeof(daemon_local->flags.pathToECUSoftwareVersion) - 1);
+                            daemon_local->flags.pathToECUSoftwareVersion[sizeof(daemon_local->flags.pathToECUSoftwareVersion) - 1]=0;
 							//printf("Option: %s=%s\n",token,value);
 						}
 						else if(strcmp(token,"SendTimezone")==0)
@@ -396,9 +406,9 @@ int main(int argc, char* argv[])
     dlt_log_init(daemon_local.flags.loggingMode);
 
     /* Print version information */
-    dlt_get_version(version);
+    dlt_get_version(version,DLT_DAEMON_TEXTBUFSIZE);
 
-    sprintf(str,"Starting DLT Daemon; %s\n", version );
+    snprintf(str,DLT_DAEMON_TEXTBUFSIZE,"Starting DLT Daemon; %s\n", version );
     dlt_log(LOG_NOTICE, str);
 
 	PRINT_FUNCTION_VERBOSE(daemon_local.flags.vflag);
@@ -467,7 +477,7 @@ int main(int argc, char* argv[])
             int error = errno;
             /* retry if SIGINT was received, else error out */
             if ( error != EINTR ) {
-                sprintf(str,"select() failed: %s\n", strerror(error) );
+                snprintf(str,DLT_DAEMON_TEXTBUFSIZE,"select() failed: %s\n", strerror(error) );
                 dlt_log(LOG_CRIT, str);
                 return -1;
             }
@@ -511,7 +521,7 @@ int main(int argc, char* argv[])
                     uint64_t expir=0;
                     ssize_t res = read(daemon_local.timer_wd, &expir, sizeof(expir));
                     if(res < 0) {
-                        sprintf(str,"Failed to read timer_wd; %s\n", strerror(errno) );
+                        snprintf(str,DLT_DAEMON_TEXTBUFSIZE,"Failed to read timer_wd; %s\n", strerror(errno) );
                         dlt_log(LOG_WARNING, str);
                         // Activity received on timer_wd, but unable to read the fd:
                         // let's go on sending notification
@@ -530,7 +540,7 @@ int main(int argc, char* argv[])
                     uint64_t expir=0;
                     ssize_t res = read(daemon_local.timer_one_s, &expir, sizeof(expir));
                     if(res < 0) {
-                        sprintf(str,"Failed to read timer_timingpacket; %s\n", strerror(errno) );
+                        snprintf(str,DLT_DAEMON_TEXTBUFSIZE,"Failed to read timer_timingpacket; %s\n", strerror(errno) );
                         dlt_log(LOG_WARNING, str);
                         // Activity received on timer_wd, but unable to read the fd:
                         // let's go on sending notification
@@ -555,7 +565,7 @@ int main(int argc, char* argv[])
                     uint64_t expir=0;
                     ssize_t res = read(daemon_local.timer_sixty_s, &expir, sizeof(expir));
                     if(res < 0) {
-                        sprintf(str,"Failed to read timer_ecuversion; %s\n", strerror(errno) );
+                        snprintf(str,DLT_DAEMON_TEXTBUFSIZE,"Failed to read timer_ecuversion; %s\n", strerror(errno) );
                         dlt_log(LOG_WARNING, str);
                         // Activity received on timer_wd, but unable to read the fd:
                         // let's go on sending notification
@@ -629,7 +639,7 @@ int dlt_daemon_local_init_p1(DltDaemon *daemon, DltDaemonLocal *daemon_local, in
     ret=mkdir(DLT_USER_DIR, S_IRUSR | S_IWUSR | S_IXUSR | S_IRGRP | S_IWGRP | S_IROTH  | S_IWOTH | S_ISVTX );
     if (ret==-1 && errno != EEXIST)
     {
-        sprintf(str,"FIFO user dir %s cannot be created!\n", DLT_USER_DIR);
+        snprintf(str,DLT_DAEMON_TEXTBUFSIZE,"FIFO user dir %s cannot be created!\n", DLT_USER_DIR);
         dlt_log(LOG_ERR, str);
         return -1;
     }
@@ -638,7 +648,7 @@ int dlt_daemon_local_init_p1(DltDaemon *daemon, DltDaemonLocal *daemon_local, in
     ret=chmod(DLT_USER_DIR, S_IRUSR | S_IWUSR | S_IXUSR | S_IRGRP | S_IWGRP | S_IXGRP | S_IROTH  | S_IWOTH | S_IXOTH | S_ISGID | S_ISVTX );
     if (ret==-1)
     {
-        sprintf(str,"FIFO user dir %s cannot be chmoded!\n", DLT_USER_DIR);
+        snprintf(str,DLT_DAEMON_TEXTBUFSIZE,"FIFO user dir %s cannot be chmoded!\n", DLT_USER_DIR);
         dlt_log(LOG_ERR, str);
         return -1;
     }
@@ -760,7 +770,12 @@ int dlt_daemon_local_init_p2(DltDaemon *daemon, DltDaemonLocal *daemon_local, in
     if(dlt_daemon_local_ecu_version_init(daemon, daemon_local, daemon_local->flags.vflag) < 0)
     {
     	daemon->ECUVersionString = malloc(DLT_DAEMON_TEXTBUFSIZE);
-    	dlt_get_version(daemon->ECUVersionString);
+    	if(daemon->ECUVersionString==0)
+        {
+        	dlt_log(LOG_ERR,"Could not allocate memory for version string\n");
+            return -1;
+        }
+        dlt_get_version(daemon->ECUVersionString,DLT_DAEMON_TEXTBUFSIZE);
     }
 
     return 0;
@@ -787,7 +802,7 @@ int dlt_daemon_local_connection_init(DltDaemon *daemon, DltDaemonLocal *daemon_l
     ret=mkfifo(DLT_USER_FIFO, S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP );
     if (ret==-1)
     {
-        sprintf(str,"FIFO user %s cannot be created!\n",DLT_USER_FIFO);
+        snprintf(str,DLT_DAEMON_TEXTBUFSIZE,"FIFO user %s cannot be created!\n",DLT_USER_FIFO);
         dlt_log(LOG_ERR, str);
         return -1;
     } /* if */
@@ -795,7 +810,7 @@ int dlt_daemon_local_connection_init(DltDaemon *daemon, DltDaemonLocal *daemon_l
     daemon_local->fp = open(DLT_USER_FIFO, O_RDWR);
     if (daemon_local->fp==-1)
     {
-        sprintf(str,"FIFO user %s cannot be opened!\n",DLT_USER_FIFO);
+        snprintf(str,DLT_DAEMON_TEXTBUFSIZE,"FIFO user %s cannot be opened!\n",DLT_USER_FIFO);
         dlt_log(LOG_ERR, str);
         return -1;
     } /* if */
@@ -825,7 +840,7 @@ int dlt_daemon_local_connection_init(DltDaemon *daemon, DltDaemonLocal *daemon_l
         daemon_local->fdserial=open(daemon_local->flags.yvalue,O_RDWR);
         if (daemon_local->fdserial<0)
         {
-            sprintf(str,"Failed to open serial device %s\n", daemon_local->flags.yvalue);
+            snprintf(str,DLT_DAEMON_TEXTBUFSIZE,"Failed to open serial device %s\n", daemon_local->flags.yvalue);
             daemon_local->flags.yvalue[0] = 0;
             dlt_log(LOG_ERR, str);
             return -1;
@@ -845,7 +860,7 @@ int dlt_daemon_local_connection_init(DltDaemon *daemon, DltDaemonLocal *daemon_l
             if (dlt_setup_serial(daemon_local->fdserial,daemon_local->baudrate)<0)
             {
                 close(daemon_local->fdserial);
-                sprintf(str,"Failed to configure serial device %s (%s) \n", daemon_local->flags.yvalue, strerror(errno));
+                snprintf(str,DLT_DAEMON_TEXTBUFSIZE,"Failed to configure serial device %s (%s) \n", daemon_local->flags.yvalue, strerror(errno));
                 daemon_local->flags.yvalue[0] = 0;
                 dlt_log(LOG_ERR, str);
                 return -1;
@@ -916,6 +931,12 @@ int dlt_daemon_local_ecu_version_init(DltDaemon *daemon, DltDaemonLocal *daemon_
 
 	/* Allocate permanent buffer for version info */
 	version = malloc(size + 1);
+	if(version==0)
+	{
+		dlt_log(LOG_ERR, "Cannot allocate memory for ECU version.\n");
+		fclose(f);
+		return -1;
+	}
 	off_t offset = 0;
 	while(!feof(f))
 	{
@@ -995,7 +1016,7 @@ void dlt_daemon_signal_handler(int sig)
     case SIGQUIT:
     {
         /* finalize the server */
-        sprintf(str,"Exiting DLT daemon due to signal: %s\n", strsignal(sig) );
+        snprintf(str,DLT_DAEMON_TEXTBUFSIZE,"Exiting DLT daemon due to signal: %s\n", strsignal(sig) );
         dlt_log(LOG_NOTICE, str);
 
         /* Try to delete existing pipe, ignore result of unlink() */
@@ -1086,7 +1107,7 @@ void dlt_daemon_daemonize(int verbose)
     }
     /* only first instance continues */
 
-    sprintf(str,"%d\n",getpid());
+    snprintf(str,DLT_DAEMON_TEXTBUFSIZE,"%d\n",getpid());
     pid_len = strlen(str);
     if(write(lfp,str,pid_len) != pid_len) /* record pid to lockfile */
         dlt_log(LOG_ERR, "Could not write pid to file in dlt_daemon_daemonize.\n");
@@ -1138,7 +1159,7 @@ int dlt_daemon_process_client_connect(DltDaemon *daemon, DltDaemonLocal *daemon_
     //flags = fcntl(in_sock, F_GETFL, 0);
     //fcntl(in_sock, F_SETFL, flags | O_NONBLOCK);
 
-    //sprintf("str,"Client Connection from %s\n", inet_ntoa(cli.sin_addr));
+    //snprintf(str,DLT_DAEMON_TEXTBUFSIZE,"Client Connection from %s\n", inet_ntoa(cli.sin_addr));
     //dlt_log(str);
     FD_SET(in_sock, &(daemon_local->master)); /* add to master set */
     if (in_sock > daemon_local->fdmax)
@@ -1150,7 +1171,7 @@ int dlt_daemon_process_client_connect(DltDaemon *daemon, DltDaemonLocal *daemon_
     daemon_local->client_connections++;
     if (daemon_local->flags.vflag)
     {
-        sprintf(str, "New connection to client established, #connections: %d\n",daemon_local->client_connections);
+        snprintf(str,DLT_DAEMON_TEXTBUFSIZE, "New connection to client established, #connections: %d\n",daemon_local->client_connections);
         dlt_log(LOG_INFO, str);
     }
 
@@ -1536,7 +1557,7 @@ int dlt_daemon_process_user_message_register_application(DltDaemon *daemon, DltD
 {
     uint32_t len=0;
     DltDaemonApplication *application;
-    char description[DLT_DAEMON_DESCSIZE];
+    char description[DLT_DAEMON_DESCSIZE+1];
     DltUserControlMsgRegisterApplication *usercontext;
 
     PRINT_FUNCTION_VERBOSE(verbose);
@@ -1562,6 +1583,8 @@ int dlt_daemon_process_user_message_register_application(DltDaemon *daemon, DltD
     {
         /* Read and store application description */
         strncpy(description, (daemon_local->receiver.buf+sizeof(DltUserHeader)+sizeof(DltUserControlMsgRegisterApplication)), len);
+        description[sizeof(description)-1]=0;
+
     }
 
     application=dlt_daemon_application_add(daemon,usercontext->apid,usercontext->pid,description,verbose);
@@ -1590,7 +1613,7 @@ int dlt_daemon_process_user_message_register_context(DltDaemon *daemon, DltDaemo
     uint32_t len=0;
     int8_t loglevel, tracestatus;
     DltUserControlMsgRegisterContext *usercontext;
-    char description[DLT_DAEMON_DESCSIZE];
+    char description[DLT_DAEMON_DESCSIZE+1];
 	DltDaemonApplication *application;
 	DltDaemonContext *context;
 	DltServiceGetLogInfoRequest *req;
@@ -1620,6 +1643,7 @@ int dlt_daemon_process_user_message_register_context(DltDaemon *daemon, DltDaemo
     {
         /* Read and store context description */
         strncpy(description, (daemon_local->receiver.buf+sizeof(DltUserHeader)+sizeof(DltUserControlMsgRegisterContext)), len);
+        description[sizeof(description)-1]=0;
     }
 
     application = dlt_daemon_application_find(daemon,usercontext->apid,verbose);
@@ -1983,7 +2007,7 @@ int dlt_daemon_process_user_message_log(DltDaemon *daemon, DltDaemonLocal *daemo
 		{
 			if(dlt_daemon_send_message_overflow(daemon,daemon_local,verbose)==0)
 			{
-				sprintf(str,"%u messages discarded!\n",daemon->overflow_counter);
+				snprintf(str,DLT_DAEMON_TEXTBUFSIZE,"%u messages discarded!\n",daemon->overflow_counter);
 				dlt_log(LOG_ERR, str);
 				daemon->overflow_counter=0;
 			}
@@ -2436,7 +2460,7 @@ int dlt_daemon_close_socket(int sock, DltDaemon *daemon, DltDaemonLocal *daemon_
 
 	if (daemon_local->flags.vflag)
 	{
-		sprintf(str, "Connection to client lost, #connections: %d\n",daemon_local->client_connections);
+		snprintf(str,DLT_DAEMON_TEXTBUFSIZE, "Connection to client lost, #connections: %d\n",daemon_local->client_connections);
 		dlt_log(LOG_INFO, str);
 	}
 
diff --git a/src/daemon/dlt_daemon_client.c b/src/daemon/dlt_daemon_client.c
index 936c462..5f85b15 100644
--- a/src/daemon/dlt_daemon_client.c
+++ b/src/daemon/dlt_daemon_client.c
@@ -719,7 +719,7 @@ void dlt_daemon_control_get_log_info(int sock, DltDaemon *daemon, DltDaemonLocal
 
     if (verbose)
     {
-        sprintf(str,"Allocate %d bytes for response msg databuffer\n", resp.datasize);
+        snprintf(str,DLT_DAEMON_TEXTBUFSIZE,"Allocate %d bytes for response msg databuffer\n", resp.datasize);
         dlt_log(LOG_INFO, str);
     }
 
@@ -753,7 +753,7 @@ void dlt_daemon_control_get_log_info(int sock, DltDaemon *daemon, DltDaemonLocal
         offset+=sizeof(uint16_t);
 
 #if (DLT_DEBUG_GETLOGINFO==1)
-        sprintf(str,"#apid: %d \n", count_app_ids);
+        snprintf(str,DLT_DAEMON_TEXTBUFSIZE,"#apid: %d \n", count_app_ids);
         dlt_log(LOG_DEBUG, str);
 #endif
 
@@ -792,7 +792,7 @@ void dlt_daemon_control_get_log_info(int sock, DltDaemon *daemon, DltDaemonLocal
 
 #if (DLT_DEBUG_GETLOGINFO==1)
                 dlt_print_id(buf, apid);
-                sprintf(str,"apid: %s\n",buf);
+                snprintf(str,DLT_DAEMON_TEXTBUFSIZE,"apid: %s\n",buf);
                 dlt_log(LOG_DEBUG, str);
 #endif
 
@@ -809,14 +809,14 @@ void dlt_daemon_control_get_log_info(int sock, DltDaemon *daemon, DltDaemonLocal
                 offset+=sizeof(uint16_t);
 
 #if (DLT_DEBUG_GETLOGINFO==1)
-                sprintf(str,"#ctid: %d \n", count_con_ids);
+                snprintf(str,DLT_DAEMON_TEXTBUFSIZE,"#ctid: %d \n", count_con_ids);
                 dlt_log(LOG_DEBUG, str);
 #endif
 
                 for (j=0;j<count_con_ids;j++)
                 {
 #if (DLT_DEBUG_GETLOGINFO==1)
-                    sprintf(str,"j: %d \n",j);
+                    snprintf(str,DLT_DAEMON_TEXTBUFSIZE,"j: %d \n",j);
                     dlt_log(LOG_DEBUG, str);
 #endif
                     if (!((count_con_ids==1) && (req->apid[0]!='\0') && (req->ctid[0]!='\0')))
@@ -836,7 +836,7 @@ void dlt_daemon_control_get_log_info(int sock, DltDaemon *daemon, DltDaemonLocal
 
 #if (DLT_DEBUG_GETLOGINFO==1)
                         dlt_print_id(buf, context->ctid);
-                        sprintf(str,"ctid: %s \n",buf);
+                        snprintf(str,DLT_DAEMON_TEXTBUFSIZE,"ctid: %s \n",buf);
                         dlt_log(LOG_DEBUG, str);
 #endif
 
@@ -876,7 +876,7 @@ void dlt_daemon_control_get_log_info(int sock, DltDaemon *daemon, DltDaemonLocal
                         }
 
 #if (DLT_DEBUG_GETLOGINFO==1)
-                        sprintf(str,"ll=%d ts=%d \n",(int32_t)ll,(int32_t)ts);
+                        snprintf(str,DLT_DAEMON_TEXTBUFSIZE,"ll=%d ts=%d \n",(int32_t)ll,(int32_t)ts);
                         dlt_log(LOG_DEBUG, str);
 #endif
                     }
diff --git a/src/daemon/dlt_daemon_common.c b/src/daemon/dlt_daemon_common.c
index be6fa26..6e9bf9b 100644
--- a/src/daemon/dlt_daemon_common.c
+++ b/src/daemon/dlt_daemon_common.c
@@ -153,24 +153,42 @@ int dlt_daemon_init(DltDaemon *daemon,const char *runtime_directory, int verbose
 
     append_length = PATH_MAX - sizeof(DLT_RUNTIME_APPLICATION_CFG);
     if(runtime_directory[0])
+    {
         strncpy(daemon->runtime_application_cfg,runtime_directory,append_length);
+        daemon->runtime_application_cfg[append_length]=0;
+    }
     else
-    	strcpy(daemon->runtime_application_cfg,DLT_RUNTIME_DEFAULT_DIRECTORY);
-    strcat(daemon->runtime_application_cfg,DLT_RUNTIME_APPLICATION_CFG);
+    {
+    	strncpy(daemon->runtime_application_cfg,DLT_RUNTIME_DEFAULT_DIRECTORY,append_length);
+        daemon->runtime_application_cfg[append_length]=0;
+    }
+    strcat(daemon->runtime_application_cfg,DLT_RUNTIME_APPLICATION_CFG); /* strcat uncritical here, because max length already checked */
 
     append_length = PATH_MAX - sizeof(DLT_RUNTIME_CONTEXT_CFG);
     if(runtime_directory[0])
+    {
         strncpy(daemon->runtime_context_cfg,runtime_directory,append_length);
+        daemon->runtime_context_cfg[append_length]=0;
+    }
     else
-    	strcpy(daemon->runtime_context_cfg,DLT_RUNTIME_DEFAULT_DIRECTORY);
-    strcat(daemon->runtime_context_cfg,DLT_RUNTIME_CONTEXT_CFG);
+    {
+    	strncpy(daemon->runtime_context_cfg,DLT_RUNTIME_DEFAULT_DIRECTORY,append_length);
+        daemon->runtime_context_cfg[append_length]=0;
+    }
+    strcat(daemon->runtime_context_cfg,DLT_RUNTIME_CONTEXT_CFG); /* strcat uncritical here, because max length already checked */
 
     append_length = PATH_MAX - sizeof(DLT_RUNTIME_CONFIGURATION);
-    if(runtime_directory[0])    
+    if(runtime_directory[0])
+    {
         strncpy(daemon->runtime_configuration,runtime_directory,append_length);
+        daemon->runtime_configuration[append_length]=0;
+    }
     else
-    	strcpy(daemon->runtime_configuration,DLT_RUNTIME_DEFAULT_DIRECTORY);
-    strcat(daemon->runtime_configuration,DLT_RUNTIME_CONFIGURATION);
+    {
+    	strncpy(daemon->runtime_configuration,DLT_RUNTIME_DEFAULT_DIRECTORY,append_length);
+        daemon->runtime_configuration[append_length]=0;
+    }
+    strcat(daemon->runtime_configuration,DLT_RUNTIME_CONFIGURATION); /* strcat uncritical here, because max length already checked */
 
     /* Check for runtime cfg, if it is loadable, load it! */
     if ((dlt_daemon_applications_load(daemon,daemon->runtime_application_cfg, verbose)==0) &&
@@ -354,7 +372,7 @@ DltDaemonApplication* dlt_daemon_application_add(DltDaemon *daemon,char *apid,pi
         application->application_description = malloc(strlen(description)+1);
         if (application->application_description)
         {
-            strncpy(application->application_description,description,strlen(description)+1);
+            strncpy(application->application_description,description,strlen(description));
             application->application_description[strlen(description)]='\0';
         }
     }
@@ -377,7 +395,7 @@ DltDaemonApplication* dlt_daemon_application_add(DltDaemon *daemon,char *apid,pi
     /* open user pipe only if it is not yet opened */
     if (application->user_handle==DLT_FD_INIT && pid!=0)
     {
-        sprintf(filename,"%s/dlt%d",DLT_USER_DIR,pid);
+        snprintf(filename,DLT_DAEMON_COMMON_TEXTBUFSIZE,"%s/dlt%d",DLT_USER_DIR,pid);
 
         dlt_user_handle = open(filename, O_WRONLY|O_NONBLOCK);
         if ( dlt_user_handle < 0 )
@@ -685,7 +703,7 @@ DltDaemonContext* dlt_daemon_context_add(DltDaemon *daemon,char *apid,char *ctid
 
         if (context->context_description)
         {
-            strncpy(context->context_description,description,strlen(description)+1);
+            strncpy(context->context_description,description,strlen(description));
             context->context_description[strlen(description)]='\0';
         }
     }
@@ -1045,11 +1063,13 @@ int dlt_daemon_configuration_load(DltDaemon *daemon,const char *filename, int ve
 
 					if(token[0]==0)
 					{
-						strncpy(token,pch,sizeof(token));
+						strncpy(token,pch,sizeof(token)-1);
+						token[sizeof(token)-1]=0;
 					}
 					else
 					{
-						strncpy(value,pch,sizeof(value));
+						strncpy(value,pch,sizeof(value)-1);
+						value[sizeof(value)-1]=0;
 						break;
 					}
 
@@ -1062,12 +1082,12 @@ int dlt_daemon_configuration_load(DltDaemon *daemon,const char *filename, int ve
 						if(strcmp(token,"LoggingMode")==0)
 						{
 							daemon->mode = atoi(value);
-							sprintf(str,"Runtime Option: %s=%d\n",token,daemon->mode);
+							snprintf(str,DLT_DAEMON_COMMON_TEXTBUFSIZE,"Runtime Option: %s=%d\n",token,daemon->mode);
 							dlt_log(LOG_INFO, str);
 						}
 						else
 						{
-							sprintf(str,"Unknown option: %s=%s\n",token,value);
+							snprintf(str,DLT_DAEMON_COMMON_TEXTBUFSIZE,"Unknown option: %s=%s\n",token,value);
 							dlt_log(LOG_ERR, str);
 						}
 					}
@@ -1081,7 +1101,7 @@ int dlt_daemon_configuration_load(DltDaemon *daemon,const char *filename, int ve
 	}
 	else
 	{
-        sprintf(str,"Cannot open configuration file: %s\n",filename);
+        snprintf(str,DLT_DAEMON_COMMON_TEXTBUFSIZE,"Cannot open configuration file: %s\n",filename);
         dlt_log(LOG_WARNING, str);
 	}	
 	
diff --git a/src/daemon/dlt_daemon_socket.c b/src/daemon/dlt_daemon_socket.c
index ca6f2ae..4888807 100644
--- a/src/daemon/dlt_daemon_socket.c
+++ b/src/daemon/dlt_daemon_socket.c
@@ -71,12 +71,12 @@ int dlt_daemon_socket_open(int *sock)
         return -1;
     } /* if */
 
-    sprintf(str,"%s: Socket created - socket_family:%i, socket_type:%i, protocol:%i\n", __FUNCTION__, socket_family, socket_type, protocol);
+    snprintf(str,DLT_DAEMON_TEXTBUFSIZE,"%s: Socket created - socket_family:%i, socket_type:%i, protocol:%i\n", __FUNCTION__, socket_family, socket_type, protocol);
     dlt_log(LOG_INFO, str);
 
     if ( -1 == setsockopt(*sock, SOL_SOCKET, SO_REUSEADDR, &yes, sizeof(int)))
     {
-        sprintf(str,"dlt_daemon_socket_open: Setsockopt error in dlt_daemon_local_connection_init: %s\n",strerror(errno));
+        snprintf(str,DLT_DAEMON_TEXTBUFSIZE,"dlt_daemon_socket_open: Setsockopt error in dlt_daemon_local_connection_init: %s\n",strerror(errno));
         dlt_log(LOG_ERR, str);
         return -1;
     }
@@ -97,11 +97,11 @@ int dlt_daemon_socket_open(int *sock)
         return -1;
     } /* if */
 
-    sprintf(str,"%s: Listening on port: %u\n",__FUNCTION__,servPort);
+    snprintf(str,DLT_DAEMON_TEXTBUFSIZE,"%s: Listening on port: %u\n",__FUNCTION__,servPort);
     dlt_log(LOG_INFO, str);
 
     /* get socket buffer size */
-    sprintf(str,"dlt_daemon_socket_open: Socket send queue size: %d\n",dlt_daemon_socket_get_send_qeue_max_size(*sock));
+    snprintf(str,DLT_DAEMON_TEXTBUFSIZE,"dlt_daemon_socket_open: Socket send queue size: %d\n",dlt_daemon_socket_get_send_qeue_max_size(*sock));
     dlt_log(LOG_INFO, str);
 
     return 0; /* OK */