- Avoid sprintf, even when checked copy'n'paste or changes lead to errors

4 files changed, 37 insertions, 40 deletions

diff --git a/main/SAPI.c b/main/SAPI.c
index d9c13d7284..db43b32ab8 100644
--- a/main/SAPI.c
+++ b/main/SAPI.c
@@ -663,8 +663,7 @@ SAPI_API int sapi_header_op(sapi_header_op_enum op, void *arg TSRMLS_DC)
 					ptr_len = strlen(ptr);
 					MAKE_STD_ZVAL(repl_temp);
 					Z_TYPE_P(repl_temp) = IS_STRING;
-					Z_STRVAL_P(repl_temp) = emalloc(32);
-					Z_STRLEN_P(repl_temp) = sprintf(Z_STRVAL_P(repl_temp), "realm=\"\\1-%ld\"", myuid);
+					Z_STRLEN_P(repl_temp) = spprintf(&Z_STRVAL_P(repl_temp), 0, "realm=\"\\1-%ld\"", myuid);
 					/* Modify quoted realm value */
 					result = php_pcre_replace("/realm=\"(.*?)\"/i", 16,
 											 ptr, ptr_len,
@@ -672,7 +671,8 @@ SAPI_API int sapi_header_op(sapi_header_op_enum op, void *arg TSRMLS_DC)
 											 0, &result_len, -1, NULL TSRMLS_CC);
 					if(result_len==ptr_len) {
 						efree(result);
-						sprintf(Z_STRVAL_P(repl_temp), "realm=\\1-%ld\\2", myuid);
+						efree(Z_STRVAL_P(repl_temp));
+						Z_STRLEN_P(repl_temp) = spprintf(&Z_STRVAL_P(repl_temp), 0, "realm=\\1-%ld\\2", myuid);
 						/* modify unquoted realm value */
 						result = php_pcre_replace("/realm=([^\\s]+)(.*)/i", 21, 
 											 	ptr, ptr_len,
@@ -687,7 +687,7 @@ SAPI_API int sapi_header_op(sapi_header_op_enum op, void *arg TSRMLS_DC)
 							/* If there is no realm string at all, append one */
 							if(!strstr(lower_temp,"realm")) {
 								efree(result);
-								conv_len = sprintf(conv_temp, " realm=\"%ld\"",myuid);
+								conv_len = snprintf(conv_temp, sizeof(conv_temp), " realm=\"%ld\"",myuid);
 								result = emalloc(ptr_len+conv_len+1);
 								result_len = ptr_len+conv_len;
 								memcpy(result, ptr, ptr_len);	
@@ -697,9 +697,7 @@ SAPI_API int sapi_header_op(sapi_header_op_enum op, void *arg TSRMLS_DC)
 							efree(lower_temp);
 						}
 					}
-					newlen = sizeof("WWW-Authenticate: ") - 1  + result_len;
-					newheader = emalloc(newlen+1);
-					sprintf(newheader,"WWW-Authenticate: %s", result);
+					newlen = spprintf(&newheader, 0, "WWW-Authenticate: %s", result);
 					efree(header_line);
 					sapi_header.header = newheader;
 					sapi_header.header_len = newlen;
@@ -820,7 +818,7 @@ SAPI_API int sapi_send_headers(TSRMLS_D)
 					http_status_line.header_len = strlen(SG(sapi_headers).http_status_line);
 				} else {
 					http_status_line.header = buf;
-					http_status_line.header_len = sprintf(buf, "HTTP/1.0 %d X", SG(sapi_headers).http_response_code);
+					http_status_line.header_len = snprintf(buf, sizeof(buf), "HTTP/1.0 %d X", SG(sapi_headers).http_response_code);
 				}
 				sapi_module.send_header(&http_status_line, SG(server_context) TSRMLS_CC);
 			}
diff --git a/main/fopen_wrappers.c b/main/fopen_wrappers.c
index 6886a56392..ebcdb711fa 100644
--- a/main/fopen_wrappers.c
+++ b/main/fopen_wrappers.c
@@ -297,13 +297,10 @@ PHPAPI int php_fopen_primary_script(zend_file_handle *file_handle TSRMLS_DC)
 			pw = getpwnam(user);
 #endif
 			if (pw && pw->pw_dir) {
-				filename = emalloc(strlen(PG(user_dir)) + strlen(path_info) + strlen(pw->pw_dir) + 4);
-				if (filename) {
-					sprintf(filename, "%s%c%s%c%s", pw->pw_dir, PHP_DIR_SEPARATOR,
+				spprintf(&filename, 0, "%s%c%s%c%s", pw->pw_dir, PHP_DIR_SEPARATOR,
 								PG(user_dir), PHP_DIR_SEPARATOR, s+1); /* Safe */
-					STR_FREE(SG(request_info).path_translated);
-					SG(request_info).path_translated = filename;
-				}
+				STR_FREE(SG(request_info).path_translated);
+				SG(request_info).path_translated = filename;
 			}
 #if defined(ZTS) && defined(HAVE_GETPWNAM_R) && defined(_SC_GETPW_R_SIZE_MAX)
 			efree(pwbuf);
diff --git a/main/php_ini.c b/main/php_ini.c
index 56b184928a..781014b0b7 100644
--- a/main/php_ini.c
+++ b/main/php_ini.c
@@ -441,8 +441,8 @@ int php_init_config(TSRMLS_D)
 		/* Search php-%sapi-module-name%.ini file in search path */
 		if (!fh.handle.fp) {
 			const char *fmt = "php-%s.ini";
-			char *ini_fname = emalloc(strlen(fmt) + strlen(sapi_module.name));
-			sprintf(ini_fname, fmt, sapi_module.name);
+			char *ini_fname;
+			spprintf(&ini_fname, 0, fmt, sapi_module.name);
 			fh.handle.fp = php_fopen_with_path(ini_fname, "r", php_ini_search_path, &php_ini_opened_path TSRMLS_CC);
 			efree(ini_fname);
 			if (fh.handle.fp) {
diff --git a/main/rfc1867.c b/main/rfc1867.c
index 2a8089e4e2..a069f924f4 100644
--- a/main/rfc1867.c
+++ b/main/rfc1867.c
@@ -365,12 +365,9 @@ static multipart_buffer *multipart_buffer_new(char *boundary, int boundary_len)
 	self->buffer = (char *) ecalloc(1, minsize + 1);
 	self->bufsize = minsize;
 
-	self->boundary = (char *) ecalloc(1, boundary_len + 3); 
-	sprintf(self->boundary, "--%s", boundary);
+	spprintf(&self->boundary, 0, "--%s", boundary);
 	
-	self->boundary_next = (char *) ecalloc(1, boundary_len + 4);
-	sprintf(self->boundary_next, "\n--%s", boundary);
-	self->boundary_next_len = boundary_len + 3;
+	self->boundary_next_len = spprintf(&self->boundary_next, 0, "\n--%s", boundary);
 
 	self->buf_begin = self->buffer;
 	self->bytes_in_buffer = 0;
@@ -797,6 +794,7 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_post_handler)
 	int fd=-1;
 	zend_llist header;
 	void *event_extra_data = NULL;
+	int llen = 0;
 
 	if (SG(request_info).content_length > SG(post_max_size)) {
 		sapi_module.sapi_error(E_WARNING, "POST Content-Length of %ld bytes exceeds the limit of %ld bytes", SG(request_info).content_length, SG(post_max_size));
@@ -1159,17 +1157,18 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_post_handler)
 			}
 			
 			/* Add $foo_name */
-			if (lbuf) {
-				efree(lbuf);
+			if (llen < strlen(param) + MAX_SIZE_OF_INDEX + 1) {
+				llen = strlen(param);
+				lbuf = (char *) safe_erealloc(lbuf, llen, 1, MAX_SIZE_OF_INDEX + 1);
+				llen += MAX_SIZE_OF_INDEX + 1;
 			}
-			lbuf = (char *) emalloc(strlen(param) + MAX_SIZE_OF_INDEX + 1);
 			
 			if (is_arr_upload) {
 				if (abuf) efree(abuf);
 				abuf = estrndup(param, strlen(param)-array_len);
-				sprintf(lbuf, "%s_name[%s]", abuf, array_index);
+				snprintf(lbuf, llen, "%s_name[%s]", abuf, array_index);
 			} else {
-				sprintf(lbuf, "%s_name", param);
+				snprintf(lbuf, llen, "%s_name", param);
 			}
 
 #if HAVE_MBSTRING && !defined(COMPILE_DL_MBSTRING)
@@ -1227,9 +1226,9 @@ filedone:
 
 			/* Add $foo[name] */
 			if (is_arr_upload) {
-				sprintf(lbuf, "%s[name][%s]", abuf, array_index);
+				snprintf(lbuf, llen, "%s[name][%s]", abuf, array_index);
 			} else {
-				sprintf(lbuf, "%s[name]", param);
+				snprintf(lbuf, llen, "%s[name]", param);
 			}
 			if (s && s > filename) {
 				register_http_post_files_variable(lbuf, s+1, http_post_files, 0 TSRMLS_CC);
@@ -1252,9 +1251,9 @@ filedone:
 
 			/* Add $foo_type */
 			if (is_arr_upload) {
-				sprintf(lbuf, "%s_type[%s]", abuf, array_index);
+				snprintf(lbuf, llen, "%s_type[%s]", abuf, array_index);
 			} else {
-				sprintf(lbuf, "%s_type", param);
+				snprintf(lbuf, llen, "%s_type", param);
 			}
 			if (!is_anonymous) {
 				safe_php_register_variable(lbuf, cd, strlen(cd), NULL, 0 TSRMLS_CC);
@@ -1262,9 +1261,9 @@ filedone:
 
 			/* Add $foo[type] */
 			if (is_arr_upload) {
-				sprintf(lbuf, "%s[type][%s]", abuf, array_index);
+				snprintf(lbuf, llen, "%s[type][%s]", abuf, array_index);
 			} else {
-				sprintf(lbuf, "%s[type]", param);
+				snprintf(lbuf, llen, "%s[type]", param);
 			}
 			register_http_post_files_variable(lbuf, cd, http_post_files, 0 TSRMLS_CC);
 
@@ -1286,9 +1285,9 @@ filedone:
 	
 			/* Add $foo[tmp_name] */
 			if (is_arr_upload) {
-				sprintf(lbuf, "%s[tmp_name][%s]", abuf, array_index);
+				snprintf(lbuf, llen, "%s[tmp_name][%s]", abuf, array_index);
 			} else {
-				sprintf(lbuf, "%s[tmp_name]", param);
+				snprintf(lbuf, llen, "%s[tmp_name]", param);
 			}
 			add_protected_variable(lbuf TSRMLS_CC);
 			register_http_post_files_variable(lbuf, temp_filename, http_post_files, 1 TSRMLS_CC);
@@ -1311,17 +1310,17 @@ filedone:
 				}	
 	
 				if (is_arr_upload) {
-					sprintf(lbuf, "%s[error][%s]", abuf, array_index);
+					snprintf(lbuf, llen, "%s[error][%s]", abuf, array_index);
 				} else {
-					sprintf(lbuf, "%s[error]", param);
+					snprintf(lbuf, llen, "%s[error]", param);
 				}
 				register_http_post_files_variable_ex(lbuf, &error_type, http_post_files, 0 TSRMLS_CC);
 
 				/* Add $foo_size */
 				if (is_arr_upload) {
-					sprintf(lbuf, "%s_size[%s]", abuf, array_index);
+					snprintf(lbuf, llen, "%s_size[%s]", abuf, array_index);
 				} else {
-					sprintf(lbuf, "%s_size", param);
+					snprintf(lbuf, llen, "%s_size", param);
 				}
 				if (!is_anonymous) {
 					safe_php_register_variable_ex(lbuf, &file_size, NULL, 0 TSRMLS_CC);
@@ -1329,9 +1328,9 @@ filedone:
 
 				/* Add $foo[size] */
 				if (is_arr_upload) {
-					sprintf(lbuf, "%s[size][%s]", abuf, array_index);
+					snprintf(lbuf, llen, "%s[size][%s]", abuf, array_index);
 				} else {
-					sprintf(lbuf, "%s[size]", param);
+					snprintf(lbuf, llen, "%s[size]", param);
 				}
 				register_http_post_files_variable_ex(lbuf, &file_size, http_post_files, 0 TSRMLS_CC);
 			}
@@ -1339,6 +1338,9 @@ filedone:
 		}
 	}
 fileupload_done:
+	if (lbuf) {
+		efree(lbuf);
+	}
 	if (php_rfc1867_callback != NULL) {
 		multipart_event_end event_end;