Merge pull request #6754 from symless/issue-6753-sprintf-vulnerability

Replaced sprintf with snprintf

ChangeLog

@@ -1,5 +1,7 @@
 v1.12.x-snapshot
 ===========
+Bug fixes:
+- #6753 Fixed a number of vulnerabilities detected by static analysis
 
 Enhancements:
 - #6750 Integrate SonarCloud for static analysis and test coverage

src/lib/base/Log.cpp

@@ -178,11 +178,12 @@ Log::print(const char* file, int line, const char* fmt, ...)
     if (priority != kPRINT) {
 
         struct tm *tm;
-        char timestamp[50];
+        static const int timestamp_size = 50;
+        char timestamp[timestamp_size];
         time_t t;
         time(&t);
         tm = localtime(&t);
-        sprintf(timestamp, "%04i-%02i-%02iT%02i:%02i:%02i", tm->tm_year + 1900, tm->tm_mon+1, tm->tm_mday, tm->tm_hour, tm->tm_min, tm->tm_sec);
+        snprintf(timestamp, timestamp_size, "%04i-%02i-%02iT%02i:%02i:%02i", tm->tm_year + 1900, tm->tm_mon+1, tm->tm_mday, tm->tm_hour, tm->tm_min, tm->tm_sec);
 
         // square brackets, spaces, comma and null terminator take about 10
         int size = 10;
@@ -197,9 +198,9 @@ Log::print(const char* file, int line, const char* fmt, ...)
         char* message = new char[size];
 
 #ifndef NDEBUG
-        sprintf(message, "[%s] %s: %s\n\t%s,%d", timestamp, g_priority[priority], buffer, file, line);
+        snprintf(message, size, "[%s] %s: %s\n\t%s,%d", timestamp, g_priority[priority], buffer, file, line);
 #else
-        sprintf(message, "[%s] %s: %s", timestamp, g_priority[priority], buffer);
+        snprintf(message, size, "[%s] %s: %s", timestamp, g_priority[priority], buffer);
 #endif
 
         output(priority, message);

src/lib/platform/XWindowsClipboard.cpp

@@ -710,8 +710,9 @@ XWindowsClipboard::motifFillCache()
     }
 
     // get the Motif item property from the root window
-    char name[18 + 20];
-    sprintf(name, "_MOTIF_CLIP_ITEM_%d", header.m_item);
+    static const int buffer_size = 18 + 20;
+    char name[buffer_size];
+    snprintf(name, buffer_size, "_MOTIF_CLIP_ITEM_%d", header.m_item);
     Atom atomItem = XInternAtom(m_display, name, False);
     data = "";
     if (!XWindowsUtil::getWindowProperty(m_display, root,
@@ -740,7 +741,7 @@ XWindowsClipboard::motifFillCache()
     MotifFormatMap motifFormats;
     for (SInt32 i = 0; i < numFormats; ++i) {
         // get Motif format property from the root window
-        sprintf(name, "_MOTIF_CLIP_ITEM_%d", formats[i]);
+        snprintf(name, buffer_size, "_MOTIF_CLIP_ITEM_%d", formats[i]);
         Atom atomFormat = XInternAtom(m_display, name, False);
         String data;
         if (!XWindowsUtil::getWindowProperty(m_display, root,
@@ -822,8 +823,9 @@ XWindowsClipboard::motifGetSelection(const MotifClipFormat* format,
     // already stored on the root window and only if it fits in a
     // property.  motif has some scheme for transferring part by
     // part that i don't know.
-    char name[18 + 20];
-    sprintf(name, "_MOTIF_CLIP_ITEM_%d", format->m_data);
+    static const int buffer_size = 18+20;
+    char name[buffer_size];
+    snprintf(name, buffer_size, "_MOTIF_CLIP_ITEM_%d", format->m_data);
        Atom target = XInternAtom(m_display, name, False);
     Window root = RootWindow(m_display, DefaultScreen(m_display));
     return XWindowsUtil::getWindowProperty(m_display, root,

src/lib/synergy/App.cpp

@@ -83,9 +83,11 @@ App::~App()
 void
 App::version()
 {
-    char buffer[500];
-    sprintf(
+    static const int buffer_size = 500;
+    char buffer[buffer_size];
+    snprintf(
         buffer,
+        buffer_size,
         "%s %s, protocol version %d.%d\n%s",
         argsBase().m_pname,
         kVersion,

src/lib/synergy/ClientApp.cpp

@@ -118,10 +118,11 @@ ClientApp::help()
 #  define WINAPI_ARG
 #  define WINAPI_INFO
 #endif
-
-    char buffer[2000];
-    sprintf(
+    static const int buffer_size = 2000;
+    char buffer[buffer_size];
+    snprintf(
         buffer,
+        buffer_size,
         "Usage: %s"
         " [--yscroll <delta>]"
         WINAPI_ARG

src/lib/synergy/ServerApp.cpp

@@ -119,10 +119,11 @@ ServerApp::help()
 #  define WINAPI_ARGS
 #  define WINAPI_INFO
 #endif
-
-    char buffer[3000];
-    sprintf(
+    static const int buffer_size = 3000;
+    char buffer[buffer_size];
+    snprintf(
         buffer,
+        buffer_size,
         "Usage: %s"
         " [--address <address>]"
         " [--config <pathname>]"