- Avoid sprintf, even when checked copy'n'paste or changes lead to errors

7 files changed, 20 insertions, 19 deletions

diff --git a/sapi/apache/php_apache.c b/sapi/apache/php_apache.c
index 98a85a5a07..99d338f151 100644
--- a/sapi/apache/php_apache.c
+++ b/sapi/apache/php_apache.c
@@ -207,20 +207,20 @@ PHP_MINFO_FUNCTION(apache)
 	} 
 
 #ifdef APACHE_RELEASE
-	sprintf(output_buf, "%d", APACHE_RELEASE);
+	snprintf(output_buf, sizeof(output_buf), "%d", APACHE_RELEASE);
 	php_info_print_table_row(2, "Apache Release", output_buf);
 #endif
-	sprintf(output_buf, "%d", MODULE_MAGIC_NUMBER);
+	snprintf(output_buf, sizeof(output_buf), "%d", MODULE_MAGIC_NUMBER);
 	php_info_print_table_row(2, "Apache API Version", output_buf);
 	snprintf(output_buf, sizeof(output_buf), "%s:%u", serv->server_hostname, serv->port);
 	php_info_print_table_row(2, "Hostname:Port", output_buf);
 #if !defined(WIN32) && !defined(WINNT)
 	snprintf(output_buf, sizeof(output_buf), "%s(%d)/%d", user_name, (int)user_id, (int)group_id);
 	php_info_print_table_row(2, "User/Group", output_buf);
-	sprintf(output_buf, "Per Child: %d - Keep Alive: %s - Max Per Connection: %d", max_requests_per_child, serv->keep_alive ? "on":"off", serv->keep_alive_max);
+	snprintf(output_buf, sizeof(output_buf), "Per Child: %d - Keep Alive: %s - Max Per Connection: %d", max_requests_per_child, serv->keep_alive ? "on":"off", serv->keep_alive_max);
 	php_info_print_table_row(2, "Max Requests", output_buf);
 #endif
-	sprintf(output_buf, "Connection: %d - Keep-Alive: %d", serv->timeout, serv->keep_alive_timeout);
+	snprintf(output_buf, sizeof(output_buf), "Connection: %d - Keep-Alive: %d", serv->timeout, serv->keep_alive_timeout);
 	php_info_print_table_row(2, "Timeouts", output_buf);
 #if !defined(WIN32) && !defined(WINNT)
 /*
diff --git a/sapi/apache2handler/php_functions.c b/sapi/apache2handler/php_functions.c
index 4b924aaf84..fd6e34ef11 100644
--- a/sapi/apache2handler/php_functions.c
+++ b/sapi/apache2handler/php_functions.c
@@ -403,7 +403,7 @@ PHP_MINFO_FUNCTION(apache)
 	if (apv && *apv) {
 		php_info_print_table_row(2, "Apache Version", apv);
 	}
-	sprintf(tmp, "%d", MODULE_MAGIC_NUMBER);
+	snprintf(tmp, sizeof(tmp), "%d", MODULE_MAGIC_NUMBER);
 	php_info_print_table_row(2, "Apache API Version", tmp);
 	
 	if (serv->server_admin && *(serv->server_admin)) {
@@ -419,7 +419,7 @@ PHP_MINFO_FUNCTION(apache)
 #endif
 
 	ap_mpm_query(AP_MPMQ_MAX_REQUESTS_DAEMON, &max_requests);
-	sprintf(tmp, "Per Child: %d - Keep Alive: %s - Max Per Connection: %d", max_requests, (serv->keep_alive ? "on":"off"), serv->keep_alive_max);
+	snprintf(tmp, sizeof(tmp), "Per Child: %d - Keep Alive: %s - Max Per Connection: %d", max_requests, (serv->keep_alive ? "on":"off"), serv->keep_alive_max);
 	php_info_print_table_row(2, "Max Requests", tmp);
 
 	apr_snprintf(tmp, sizeof tmp,
diff --git a/sapi/apache_hooks/php_apache.c b/sapi/apache_hooks/php_apache.c
index ce916d6a01..fb56d3dfb8 100644
--- a/sapi/apache_hooks/php_apache.c
+++ b/sapi/apache_hooks/php_apache.c
@@ -1609,20 +1609,20 @@ PHP_MINFO_FUNCTION(apache)
 	php_info_print_table_row(2, "Apache Version", SERVER_VERSION);
 
 #ifdef APACHE_RELEASE
-	sprintf(output_buf, "%d", APACHE_RELEASE);
+	snprintf(output_buf, sizeof(output_buf), "%d", APACHE_RELEASE);
 	php_info_print_table_row(2, "Apache Release", output_buf);
 #endif
-	sprintf(output_buf, "%d", MODULE_MAGIC_NUMBER);
+	snprintf(output_buf, sizeof(output_buf), "%d", MODULE_MAGIC_NUMBER);
 	php_info_print_table_row(2, "Apache API Version", output_buf);
 	snprintf(output_buf, sizeof(output_buf), "%s:%u", serv->server_hostname, serv->port);
 	php_info_print_table_row(2, "Hostname:Port", output_buf);
 #if !defined(WIN32) && !defined(WINNT)
 	snprintf(output_buf, sizeof(output_buf), "%s(%d)/%d", user_name, (int)user_id, (int)group_id);
 	php_info_print_table_row(2, "User/Group", output_buf);
-	sprintf(output_buf, "Per Child: %d - Keep Alive: %s - Max Per Connection: %d", max_requests_per_child, serv->keep_alive ? "on":"off", serv->keep_alive_max);
+	snprintf(output_buf, sizeof(output_buf), "Per Child: %d - Keep Alive: %s - Max Per Connection: %d", max_requests_per_child, serv->keep_alive ? "on":"off", serv->keep_alive_max);
 	php_info_print_table_row(2, "Max Requests", output_buf);
 #endif
-	sprintf(output_buf, "Connection: %d - Keep-Alive: %d", serv->timeout, serv->keep_alive_timeout);
+	snprintf(output_buf, sizeof(output_buf), "Connection: %d - Keep-Alive: %d", serv->timeout, serv->keep_alive_timeout);
 	php_info_print_table_row(2, "Timeouts", output_buf);
 #if !defined(WIN32) && !defined(WINNT)
 /*
diff --git a/sapi/cgi/cgi_main.c b/sapi/cgi/cgi_main.c
index c1982fa863..fba7686f73 100644
--- a/sapi/cgi/cgi_main.c
+++ b/sapi/cgi/cgi_main.c
@@ -333,7 +333,7 @@ static int sapi_cgi_send_headers(sapi_headers_struct *sapi_headers TSRMLS_DC)
 			}
 
 		} else {
-			len = sprintf(buf, "Status: %d\r\n", SG(sapi_headers).http_response_code);
+			len = snprintf(buf, sizeof(buf), "Status: %d\r\n", SG(sapi_headers).http_response_code);
 		}
 
 		PHPWRITE_H(buf, len);
diff --git a/sapi/cli/php_cli_readline.c b/sapi/cli/php_cli_readline.c
index 23c5ae0c1d..8d442a7d41 100644
--- a/sapi/cli/php_cli_readline.c
+++ b/sapi/cli/php_cli_readline.c
@@ -418,9 +418,10 @@ TODO:
 			efree(class_name);
 		}
 		if (pce && retval) {
-			char *tmp = malloc(class_name_len + 2 + strlen(retval) + 1);
+			int len = class_name_len + 2 + strlen(retval) + 1;
+			char *tmp = malloc(len);
 			
-			sprintf(tmp, "%s::%s", (*pce)->name, retval);
+			snprintf(tmp, len, "%s::%s", (*pce)->name, retval);
 			free(retval);
 			retval = tmp;
 		}
diff --git a/sapi/nsapi/nsapi.c b/sapi/nsapi/nsapi.c
index b747c59603..9e0bd47ffe 100644
--- a/sapi/nsapi/nsapi.c
+++ b/sapi/nsapi/nsapi.c
@@ -642,7 +642,7 @@ static void sapi_nsapi_register_server_variables(zval *track_vars_array TSRMLS_D
 		nsapi_free(value);
 	}
 
-	sprintf(buf, "%d", conf_getglobals()->Vport);
+	snprintf(buf, sizeof(buf), "%d", conf_getglobals()->Vport);
 	php_register_variable("SERVER_PORT", buf, track_vars_array TSRMLS_CC);
 	php_register_variable("SERVER_NAME", conf_getglobals()->Vserver_hostname, track_vars_array TSRMLS_CC);
 
@@ -695,7 +695,7 @@ static void sapi_nsapi_register_server_variables(zval *track_vars_array TSRMLS_D
 
 	/* special variables in error mode */
 	if (rc->http_error) {
-		sprintf(buf, "%d", rc->http_error);
+		snprintf(buf, sizeof(buf), "%d", rc->http_error);
 		php_register_variable("ERROR_TYPE", buf, track_vars_array TSRMLS_CC);
 	}
 }
diff --git a/sapi/tux/php_tux.c b/sapi/tux/php_tux.c
index 23ca6ab0ec..fd11bd8a42 100644
--- a/sapi/tux/php_tux.c
+++ b/sapi/tux/php_tux.c
@@ -116,7 +116,7 @@ static int sapi_tux_send_headers(sapi_headers_struct *sapi_headers)
 	status_line = malloc(30);
 	
 	/* safe sprintf use */
-	len = sprintf(status_line, "HTTP/1.1 %d NA\r\n", SG(sapi_headers).http_response_code);
+	len = snprintf(status_line, 30, "HTTP/1.1 %d NA\r\n", SG(sapi_headers).http_response_code);
 	
 	vec[0].iov_base = status_line;
 	vec[0].iov_len = len;
@@ -195,7 +195,7 @@ static void sapi_tux_register_variables(zval *track_vars_array TSRMLS_DC)
 	sapi_header_line ctr = {0};
 	
 	ctr.line = buf;
-	ctr.line_len = sprintf(buf, "Server: %s", TUXAPI_version);
+	ctr.line_len = snprintf(buf, sizeof(buf), "Server: %s", TUXAPI_version);
 	sapi_header_op(SAPI_HEADER_REPLACE, &ctr TSRMLS_CC);
 	
 	php_register_variable("PHP_SELF", SG(request_info).request_uri, track_vars_array TSRMLS_CC);
@@ -215,7 +215,7 @@ static void sapi_tux_register_variables(zval *track_vars_array TSRMLS_DC)
 		ADD_STRING("REMOTE_HOST");
 	}
 
-	sprintf(buf, "%d", CGI_SERVER_PORT(TG(req)));
+	snprintf(buf, sizeof(buf), "%d", CGI_SERVER_PORT(TG(req)));
 	ADD_STRING("SERVER_PORT");
 
 #if 0
@@ -241,7 +241,7 @@ static void sapi_tux_register_variables(zval *track_vars_array TSRMLS_DC)
 
 #if 0
 	if (TG(hc)->contentlength != -1) {
-		sprintf(buf, "%ld", (long) TG(hc)->contentlength);
+		snprintf(buf, sizeof(buf), "%ld", (long) TG(hc)->contentlength);
 		ADD_STRING("CONTENT_LENGTH");
 	}
 #endif