Use memory safe snprintf() in Connect Engine

This commit replaces sprintf(buf, ...) with
snprintf(buf, sizeof(buf), ...),
specifically in the "easy" cases where buf is allocated with a size
known at compile time.

The changes make sure we are not write outside array/string bounds which
will lead to undefined behaviour. In case the code is trying to write
outside bounds - safe version of functions simply cut the string
messages so we process this gracefully.

All new code of the whole pull request, including one or several files
that are either new files or modified ones, are contributed under the BSD-new
license.  I am contributing on behalf of my employer Amazon Web Services,
Inc.

bsonudf.cpp warnings cleanup by Daniel Black

Reviewer: Daniel Black

1 files changed, 5 insertions, 5 deletions

diff --git a/storage/connect/tabodbc.cpp b/storage/connect/tabodbc.cpp
index bede19f7344..2a4ee89b235 100644
--- a/storage/connect/tabodbc.cpp
+++ b/storage/connect/tabodbc.cpp
@@ -109,7 +109,7 @@ bool ODBCDEF::DefineAM(PGLOBAL g, LPCSTR am, int poff)
   Desc = Connect = GetStringCatInfo(g, "Connect", NULL);
 
   if (!Connect && !Catfunc) {
-    sprintf(g->Message, "Missing connection for ODBC table %s", Name);
+    snprintf(g->Message, sizeof(g->Message), "Missing connection for ODBC table %s", Name);
     return true;
   } // endif Connect
 
@@ -607,7 +607,7 @@ bool TDBODBC::OpenDB(PGLOBAL g)
         if ((n = Ocp->GetResultSize(Query->GetStr(), Cnp)) < 0) {
 					char* msg = PlugDup(g, g->Message);
 
-					sprintf(g->Message, "Get result size: %s (rc=%d)", msg, n);
+					snprintf(g->Message, sizeof(g->Message), "Get result size: %s (rc=%d)", msg, n);
 					return true;
 				} else if (n) {
 					Ocp->m_Rows = n;
@@ -652,7 +652,7 @@ bool TDBODBC::OpenDB(PGLOBAL g)
   } else if (Mode == MODE_UPDATE || Mode == MODE_DELETE) {
     rc = false;  // wait for CheckCond before calling MakeCommand(g);
   } else
-    sprintf(g->Message, "Invalid mode %d", Mode);
+    snprintf(g->Message, sizeof(g->Message), "Invalid mode %d", Mode);
 
   if (rc) {
     Ocp->Close();
@@ -777,7 +777,7 @@ int TDBODBC::ReadDB(PGLOBAL g)
 
     // Send the UPDATE/DELETE command to the remote table
     if (!Ocp->ExecSQLcommand(Query->GetStr())) {
-      sprintf(g->Message, "%s: %d affected rows", TableName, AftRows);
+      snprintf(g->Message, sizeof(g->Message), "%s: %d affected rows", TableName, AftRows);
 
       if (trace(1))
         htrc("%s\n", g->Message);
@@ -853,7 +853,7 @@ int TDBODBC::DeleteDB(PGLOBAL g, int irc)
 
     // Send the DELETE (all) command to the remote table
     if (!Ocp->ExecSQLcommand(Query->GetStr())) {
-      sprintf(g->Message, "%s: %d affected rows", TableName, AftRows);
+      snprintf(g->Message, sizeof(g->Message), "%s: %d affected rows", TableName, AftRows);
 
       if (trace(1))
         htrc("%s\n", g->Message);