Security fixes
authorNelson Ferreira <nelson.ferreira@ieee.org>
Tue, 4 Oct 2011 05:16:11 +0000 (01:16 -0400)
committerNelson Ferreira <nelson.ferreira@ieee.org>
Tue, 4 Oct 2011 05:16:11 +0000 (01:16 -0400)
* src/alloc.c (garbage-collect): check return of snprintf
* src/doprnt.c (emacs_doprnt_smZ): ditto
* src/dumper.c (pdump_file_try): ditto
* src/dumper.c (pdump_load): ditto
* src/editfns.c (Fencode_time): ditto
* src/editfns.c (Fencode_btime): ditto
* src/editfns.c (current_time_zone): ditto
* src/ent/ent-float.c (vars_of_ent_float): ditto
* src/filelock.c (lock_file_1): ditto
* src/media/sound-arts.c (sound_arts_play): ditto
* src/mule/mule-ccl.c (ccl_driver): ditto
* src/opaque.c (print_opaque_ptr): ditto
* src/strftime.c (add_num_time_t): ditto

* src/casetab.c (print_case_table): use write_fmt_str instead of sprintf
* src/elhash.c (print_hash_table): ditto
* src/events/event-stream.c (print_timeout): ditto
* src/events/events.c (print_event): ditto
* src/media/sound-nas.c (sound_nas_print): ditto
* src/media/sound.c (print_audio_job): ditto
* src/opaque.c (print_opaque): ditto
* src/openssl.c (print_evp_pkey): ditto
* src/symbols.c (print_symbol_value_magic): ditto

* src/filelock.c (lock_file): Use snprintf instead of sprintf
* src/libsst.c (sst_set_ger): ditto
* src/libsst.c (sst_set_gr): ditto
* src/libsst.c (sst_set_gx): ditto
* src/libsst.c (sst_tones): ditto
* src/libsst.c (sst_dmtf): ditto
* src/print.c (float_to_string): ditto
* src/process-unix.c (allocate_pty_the_old_fashioned_way): ditto
* src/process-unix.c (unix_open_network_stream): ditto
* src/s/hpux.h (PTY_TTY_NAME_SPRINTF): ditto
* src/s/rtu.h (PTY_TTY_NAME_SPRINTF): ditto
* src/s/sco4.h (PTY_TTY_NAME_SPRINTF): ditto
* src/s/sco5.h (PTY_TTY_NAME_SPRINTF): ditto

* src/data.c (Fnumber_to_string): correct arguments to new buffer
size aware float_to_string and long_to_string

* src/doprnt.c (emacs_doprnt_number): correct arguments to new
buffer size aware long_to_string
* src/print.c (print_internal): ditto
* src/ui/redisplay.c (window_line_number): ditto
* src/ui/redisplay.c (decode_mode_spec): ditto

* src/ent/ent-float.c (print_float):  correct arguments to new
buffer size aware float_to_string

* src/ent/ent-float.h: define new argument for float_to_string
* src/lisp.h: define new argument for long_to_string

* src/emacs.c (assert_failed): flush stderr to make sure assertion is written.

* src/print.c (float_to_string): rewrite so that it knows size and
does not overflow buf. Also uses snprintf instead of sprintf

* src/print.c (long_to_string): ditto.

Signed-off-by: Nelson Ferreira <nelson.ferreira@ieee.org>
31 files changed:
src/alloc.c
src/casetab.c
src/data.c
src/doprnt.c
src/dumper.c
src/editfns.c
src/elhash.c
src/emacs.c
src/ent/ent-float.c
src/ent/ent-float.h
src/ent/ent-gmp.c
src/events/event-stream.c
src/events/events.c
src/filelock.c
src/libsst.c
src/lisp.h
src/media/sound-arts.c
src/media/sound-nas.c
src/media/sound.c
src/mule/mule-ccl.c
src/opaque.c
src/openssl.c
src/print.c
src/process-unix.c
src/s/hpux.h
src/s/rtu.h
src/s/sco4.h
src/s/sco5.h
src/strftime.c
src/symbols.c
src/ui/redisplay.c

index b0878f4..ab31f2d 100644 (file)
@@ -4960,6 +4960,8 @@ Garbage collection happens automatically if you cons more than
                        const char *name =
                            lrecord_implementations_table[i]->name;
                        int len = strlen(name);
+                       int sz;
+
                        /* save this for the FSFmacs-compatible part of the
                           summary */
                        if (i == lrecord_type_vector)
@@ -4967,31 +4969,35 @@ Garbage collection happens automatically if you cons more than
                                    lcrecord_stats[i].bytes_in_use +
                                    lcrecord_stats[i].bytes_freed;
 
-                       snprintf(buf, sizeof(buf), "%s-storage", name);
+                       sz = snprintf(buf, sizeof(buf), "%s-storage", name);
+                       assert(sz >=0  && sz < sizeof(buf));
                        pl = gc_plist_hack(buf, lcrecord_stats[i].bytes_in_use,
                                           pl);
                        /* Okay, simple pluralization check for
                           `symbol-value-varalias' */
                        if (name[len - 1] == 's')
-                                snprintf(buf, sizeof(buf), "%ses-freed", name);
+                                sz = snprintf(buf, sizeof(buf), "%ses-freed", name);
                        else
-                               snprintf(buf, sizeof(buf), "%ss-freed", name);
+                               sz = snprintf(buf, sizeof(buf), "%ss-freed", name);
+                       assert(sz >=0  && sz < sizeof(buf));
                        if (lcrecord_stats[i].instances_freed != 0)
                                pl = gc_plist_hack(buf,
                                                   lcrecord_stats[i].
                                                   instances_freed, pl);
                        if (name[len - 1] == 's')
-                               snprintf(buf, sizeof(buf), "%ses-on-free-list", name);
+                               sz = snprintf(buf, sizeof(buf), "%ses-on-free-list", name);
                        else
-                               snprintf(buf, sizeof(buf), "%ss-on-free-list", name);
+                               sz = snprintf(buf, sizeof(buf), "%ss-on-free-list", name);
+                       assert(sz >=0  && sz < sizeof(buf));
                        if (lcrecord_stats[i].instances_on_free_list != 0)
                                pl = gc_plist_hack(buf,
                                                   lcrecord_stats[i].
                                                   instances_on_free_list, pl);
                        if (name[len - 1] == 's')
-                               snprintf(buf, sizeof(buf), "%ses-used", name);
+                               sz = snprintf(buf, sizeof(buf), "%ses-used", name);
                        else
-                               snprintf(buf, sizeof(buf), "%ss-used", name);
+                               sz = snprintf(buf, sizeof(buf), "%ss-used", name);
+                       assert(sz >=0  && sz < sizeof(buf));
                        pl = gc_plist_hack(buf,
                                           lcrecord_stats[i].instances_in_use,
                                           pl);
index dd8426d..0af249d 100644 (file)
@@ -70,13 +70,10 @@ static void
 print_case_table(Lisp_Object obj, Lisp_Object printcharfun, int escapeflag)
 {
        Lisp_Case_Table *ct = XCASE_TABLE(obj);
-       char buf[200];
        if (print_readably)
                error("printing unreadable object #<case-table 0x%x",
                      ct->header.uid);
-       write_c_string("#<case-table ", printcharfun);
-       sprintf(buf, "0x%x>", ct->header.uid);
-       write_c_string(buf, printcharfun);
+       write_fmt_str(printcharfun, "#<case-table 0x%x>", ct->header.uid);
 }
 
 static const struct lrecord_description case_table_description[] = {
index 5d950db..8518476 100644 (file)
@@ -1001,7 +1001,7 @@ NUMBER may be an integer or a floating point number.
        if (FLOATP(number)) {
                char pigbuf[350];       /* see comments in float_to_string */
 
-               float_to_string(pigbuf, XFLOAT_DATA(number));
+               float_to_string(pigbuf, XFLOAT_DATA(number), sizeof(pigbuf));
                return build_string(pigbuf);
        }
 #endif  /* HAVE_FPFLOAT */
@@ -1069,7 +1069,7 @@ NUMBER may be an integer or a floating point number.
                return retval;
        }
 
-       long_to_string(buffer, XINT(number));
+       long_to_string(buffer, XINT(number), sizeof(buffer));
        return build_string(buffer);
 }
 
index c66ec4c..23de309 100644 (file)
@@ -743,7 +743,7 @@ emacs_doprnt_smZ(Lisp_Object stream, EMACS_INT Z, printf_spec_t s,  char ch)
        } else /* ch == 'b' */ {
                text_len = __ulong_to_bit_string(text, Z);
        }
-
+       assert(text_len >= 0 && text_len < alloc_sz);
        /* postprocess, move stuff around, insert naughts, etc. */
        text_len = __postproc2(s, text, text_len, alloc_sz);
 
@@ -961,6 +961,7 @@ emacs_doprnt_number(Lisp_Object stream,
                char *p = constructed_spec;
                int length, alloca_sz = max_float_print_size;
                int min = spec->minwidth, prec = spec->precision;
+               int max_spec = sizeof(constructed_spec);
 
 #if 0
                /* absolute non-sense :O ...
@@ -996,20 +997,27 @@ emacs_doprnt_number(Lisp_Object stream,
                        *p++ = '0';
 
                if (spec->minwidth >= 0) {
-                       long_to_string(p, spec->minwidth);
+                       long_to_string(p, spec->minwidth, max_spec);
+                       max_spec -= strlen(p);
                        p += strlen (p);
                }
                if (spec->precision >= 0) {
                        *p++ = '.';
-                       long_to_string(p, spec->precision);
+                       --max_spec;
+                       long_to_string(p, spec->precision, max_spec);
+                       max_spec -= strlen(p);
                        p += strlen (p);
                }
 
 #if fpfloat_long_double_p
                *p++ = 'L';
+               --max_spec;
 #endif
                *p++ = ch;
+               --max_spec;
                *p++ = '\0';
+               --max_spec;
+               assert(max_spec >= 0);
                if (NILP(obj))
                        length = snprintf(text_to_print, alloca_sz,
                                          constructed_spec, arg.d);
@@ -1017,9 +1025,10 @@ emacs_doprnt_number(Lisp_Object stream,
                        length = snprintf(text_to_print, alloca_sz,
                                          constructed_spec, XFLOAT_DATA(obj));
 
-               if (length > alloca_sz)
+               if (length > alloca_sz) {
+                       /* should we really silently truncate?! */
                        length = alloca_sz;
-
+               }
                doprnt_1(stream, (Bufbyte *)text_to_print, length, 0, -1, 0, 0);
                return;
 
index 1d9e565..9e56aa0 100644 (file)
@@ -1264,15 +1264,16 @@ static int pdump_file_get(const char *path)
 static int pdump_file_try(char *exe_path, size_t size)
 {
         char *w = exe_path + strlen(exe_path);
+        int sz;
         size -= strlen(exe_path);
 
        do {
 
 #ifdef EMACS_PATCH_LEVEL
-               snprintf(w, size, "-%d.%d.%d-%08x.dmp", 
+               sz = snprintf(w, size, "-%d.%d.%d-%08x.dmp", 
                          EMACS_MAJOR_VERSION, EMACS_MINOR_VERSION,
                          EMACS_PATCH_LEVEL, dump_id);
-               if (pdump_file_get(exe_path)) {
+               if (sz >=0 && sz < size && pdump_file_get(exe_path)) {
                        if (pdump_load_check()) {
                                return 1;
                        }
@@ -1280,10 +1281,10 @@ static int pdump_file_try(char *exe_path, size_t size)
                }
 #endif /* EMACS_PATCH_LEVEL */
 #ifdef EMACS_BETA_VERSION
-               snprintf(w, size, "-%d.%d.%d-%08x.dmp", 
+               sz = snprintf(w, size, "-%d.%d.%d-%08x.dmp", 
                          EMACS_MAJOR_VERSION, EMACS_MINOR_VERSION,
                          EMACS_BETA_VERSION, dump_id);
-               if (pdump_file_get(exe_path)) {
+               if (sz >=0 && sz < size && pdump_file_get(exe_path)) {
                        if (pdump_load_check()) {
                                return 1;
                        }
@@ -1291,16 +1292,16 @@ static int pdump_file_try(char *exe_path, size_t size)
                }
 #endif /* EMACS_BETA_VERSION */
 
-               snprintf(w, size, "-%08x.dmp", dump_id);
-               if (pdump_file_get(exe_path)) {
+               sz = snprintf(w, size, "-%08x.dmp", dump_id);
+               if (sz >=0 && sz < size && pdump_file_get(exe_path)) {
                        if (pdump_load_check()) {
                                return 1;
                        }
                        pdump_free();
                }
 
-               snprintf(w, size, ".dmp");
-               if (pdump_file_get(exe_path)) {
+               sz = snprintf(w, size, ".dmp");
+               if (sz >=0 && sz < size && pdump_file_get(exe_path)) {
                        if (pdump_load_check()) {
                                return 1;
                        }
@@ -1419,8 +1420,9 @@ int pdump_load(const char *argv0)
 
                        if (!*p) {
                                /* Oh well, let's have some kind of default */
-                               snprintf(exe_path, sizeof(exe_path),
-                                        "./%s", name);
+                               int sz = snprintf(exe_path, sizeof(exe_path),
+                                                 "./%s", name);
+                               assert(sz >= 0 && sz < sizeof(exe_path));
                                break;
                        }
                        path = p + 1;
index e399a6b..98e7507 100644 (file)
@@ -1349,9 +1349,10 @@ If you want them to stand for years in this century, you must do that yourself.
                        tzstring = (char *)XSTRING_DATA(zone);
                } else if (INTP(zone)) {
                        int abszone = abs(XINT(zone));
-                       snprintf(tzbuf, countof(tzbuf) - 1, "XXX%s%d:%02d:%02d",
-                                "-" + (XINT(zone) < 0), abszone / (60 * 60),
-                                (abszone / 60) % 60, abszone % 60);
+                       int sz = snprintf(tzbuf, sizeof(tzbuf), "XXX%s%d:%02d:%02d",
+                                         "-" + (XINT(zone) < 0), abszone / (60 * 60),
+                                         (abszone / 60) % 60, abszone % 60);
+                       assert(sz >= 0 && sz < sizeof(tzbuf));
                        tzstring = tzbuf;
                } else {
                        error("Invalid time zone specification");
@@ -1423,9 +1424,10 @@ Like `encode-time' but return a big integer time instead.
                        tzstring = (char *)XSTRING_DATA(zone);
                else if (INTP(zone)) {
                        int abszone = abs(XINT(zone));
-                       sprintf(tzbuf, "XXX%s%d:%02d:%02d",
-                               "-" + (XINT(zone) < 0), abszone / (60 * 60),
-                               (abszone / 60) % 60, abszone % 60);
+                       int sz = snprintf(tzbuf, sizeof(tzbuf), "XXX%s%d:%02d:%02d",
+                                         "-" + (XINT(zone) < 0), abszone / (60 * 60),
+                                         (abszone / 60) % 60, abszone % 60);
+                       assert(sz>=0 && sz < sizeof(tzbuf));
                        tzstring = tzbuf;
                } else
                        error("Invalid time zone specification");
@@ -1561,8 +1563,10 @@ the data it can't find.
                        /* No local time zone name is available; use "+-NNNN"
                           instead.  */
                        int am = (offset < 0 ? -offset : offset) / 60;
-                       sprintf(buf, "%c%02d%02d", (offset < 0 ? '-' : '+'),
-                               am / 60, am % 60);
+                       int sz = snprintf(buf, sizeof(buf), "%c%02d%02d", 
+                                         (offset < 0 ? '-' : '+'),
+                                         am / 60, am % 60);
+                       assert(sz>=0 && sz < sizeof(buf));
                        s = buf;
                }
                return list2(make_int(offset), build_string(s));
index c4f6466..fbd4f77 100644 (file)
@@ -264,7 +264,6 @@ static void
 print_hash_table(Lisp_Object obj, Lisp_Object printcharfun, int escapeflag)
 {
        hash_table_t ht = XHASH_TABLE(obj);
-       char buf[128];
 
        write_c_string(print_readably ? "#s(hash-table" : "#<hash-table",
                       printcharfun);
@@ -283,23 +282,21 @@ print_hash_table(Lisp_Object obj, Lisp_Object printcharfun, int escapeflag)
 
        if (ht->count || !print_readably) {
                if (print_readably)
-                       sprintf(buf, " size %lu", (unsigned long)ht->count);
+                       write_fmt_str(printcharfun, " size %lu", (unsigned long)ht->count);
                else
-                       sprintf(buf, " size %lu/%lu",
-                               (unsigned long)ht->count,
-                               (unsigned long)ht->size);
-               write_c_string(buf, printcharfun);
+                       write_fmt_str(printcharfun, " size %lu/%lu",
+                                     (unsigned long)ht->count,
+                                     (unsigned long)ht->size);
        }
 
        if (ht->weakness != HASH_TABLE_NON_WEAK) {
-               sprintf(buf, " weakness %s",
-                       (ht->weakness == HASH_TABLE_WEAK ? "key-and-value" :
-                        ht->weakness == HASH_TABLE_KEY_WEAK ? "key" :
-                        ht->weakness == HASH_TABLE_VALUE_WEAK ? "value" :
-                        ht->weakness ==
-                        HASH_TABLE_KEY_VALUE_WEAK ? "key-or-value" :
-                        "you-d-better-not-see-this"));
-               write_c_string(buf, printcharfun);
+               write_fmt_str(printcharfun, " weakness %s",
+                             (ht->weakness == HASH_TABLE_WEAK ? "key-and-value" :
+                              ht->weakness == HASH_TABLE_KEY_WEAK ? "key" :
+                              ht->weakness == HASH_TABLE_VALUE_WEAK ? "value" :
+                              ht->weakness ==
+                              HASH_TABLE_KEY_VALUE_WEAK ? "key-or-value" :
+                              "you-d-better-not-see-this"));
        }
 
        if (ht->count)
@@ -307,10 +304,8 @@ print_hash_table(Lisp_Object obj, Lisp_Object printcharfun, int escapeflag)
 
        if (print_readably)
                write_c_string(")", printcharfun);
-       else {
-               sprintf(buf, " 0x%x>", ht->header.uid);
-               write_c_string(buf, printcharfun);
-       }
+       else
+               write_fmt_str(printcharfun, " 0x%x>", ht->header.uid);
 }
 
 static void finalize_hash_table(void *header, int for_disksave)
index 272de9e..d426640 100644 (file)
@@ -3264,6 +3264,7 @@ assert_failed(const char *file, int line, const char *expr)
                            ("\nFatal error: assertion failed, file %s, line %d, %s\n",
                             file, line, expr);
        }
+       fflush(stderr);
 
        enter_debugger();
 #if !defined (ASSERTIONS_DONT_ABORT)
index a934ce5..6afa30e 100644 (file)
@@ -82,7 +82,7 @@ print_float(Lisp_Object obj, Lisp_Object printcharfun, int escapeflag)
 {
        char pigbuf[350];       /* see comments in float_to_string */
 
-       float_to_string(pigbuf, XFLOAT_DATA(obj));
+       float_to_string(pigbuf, XFLOAT_DATA(obj), sizeof(pigbuf));
        write_c_string(pigbuf, printcharfun);
 }
 
@@ -587,10 +587,12 @@ The float closest in value to -infinity.
 
        /* let's compute the array we need to print such a float */
 #if fpfloat_double_p
-       max_float_print_size = snprintf(NULL, 0, "%f", fp) + 10;
+       max_float_print_size = snprintf(NULL, 0, "%f", fp);
 #elif fpfloat_long_double_p
-       max_float_print_size = snprintf(NULL, 0, "%Lf", fp) + 10;
+       max_float_print_size = snprintf(NULL, 0, "%Lf", fp);
 #endif
+       assert(max_float_print_size>0);
+       max_float_print_size += 10;
 
        DEFVAR_CONST_INT("max-float-print-size", &max_float_print_size /*
 The maximal string length of a printed float.
index 77defc7..72eb7f9 100644 (file)
@@ -68,7 +68,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>. */
 extern Lisp_Object Qfloat;
 
 extern void print_float(Lisp_Object, Lisp_Object, int);
-extern void float_to_string(char*, fpfloat);
+extern void float_to_string(char*, fpfloat, int);
 
 /* Note: the 'unused_next_' field exists only to ensure that the
    `next' pointer fits within the structure, for the purposes of the
index e3a20d9..d8b9eda 100644 (file)
@@ -226,19 +226,6 @@ bigf_to_string(mpf_t f, int base)
                str[expt] = '\0';
                len = expt + 1;
        }
-#if 0
-       /* never want this here */
-       /* Computerized scientific notation */
-       /* We need room for a radix point, format identifier, and exponent */
-       const int space = (expt < 0)
-               ? (int)(log(-expt) / log(base)) + 3
-               : (int)(log(expt) / log(base)) + 2;
-       xrealloc_array(str, Bufbyte, len + space);
-       memmove(&str[neg + 2], &str[neg + 1], len - neg);
-       str[len + 1] = 'l';
-       sprintf ((char *)&str[len + 2], "%ld", expt);
-}
-#endif
        return str;
 }
 
index e7d4a84..1a54fad 100644 (file)
@@ -1030,11 +1030,8 @@ static void
 print_timeout(Lisp_Object obj, Lisp_Object printcharfun, int escapeflag)
 {
        const Lisp_Timeout *t = XTIMEOUT(obj);
-       char buf[64];
-
-       sprintf(buf, "#<INTERNAL OBJECT (SXEmacs bug?) (timeout) 0x%lx>",
-               (unsigned long)t);
-       write_c_string(buf, printcharfun);
+       write_fmt_string(printcharfun, "#<INTERNAL OBJECT (SXEmacs bug?) (timeout) 0x%lx>",
+                        (unsigned long)t);
 }
 
 static const struct lrecord_description timeout_description[] = {
index c7b3a72..04aa180 100644 (file)
@@ -262,9 +262,8 @@ print_event(Lisp_Object obj, Lisp_Object printcharfun, int escapeflag)
                assert(INTP(Vx));
                Vy = Fevent_y_pixel(obj);
                assert(INTP(Vy));
-               sprintf(buf, "#<motion-event %ld, %ld", (long)XINT(Vx),
-                       (long)XINT(Vy));
-               write_c_string(buf, printcharfun);
+               write_fmt_str(printcharfun, "#<motion-event %ld, %ld", (long)XINT(Vx),
+                             (long)XINT(Vy));
                break;
        }
        case process_event:
index 941201e..00be8ea 100644 (file)
@@ -122,6 +122,7 @@ static int lock_file_1(char *lfname, int force)
        char *lock_info_str;
        char *host_name;
        char *user_name = user_login_name(NULL);
+       int sz, maxlen;
 
        if (user_name == NULL)
                user_name = "";
@@ -131,11 +132,13 @@ static int lock_file_1(char *lfname, int force)
        else
                host_name = "";
 
-       lock_info_str = (char *)alloca(strlen(user_name) + strlen(host_name)
-                                      + LOCK_PID_MAX + 5);
+       maxlen = strlen(user_name) + strlen(host_name)
+               + LOCK_PID_MAX + 5
+       lock_info_str = (char *)alloca(maxlen);
 
-       sprintf(lock_info_str, "%s@%s.%lu", user_name, host_name,
-               (unsigned long)getpid());
+       sz = snprintf(lock_info_str, maxlen, "%s@%s.%lu", user_name, host_name,
+                     (unsigned long)getpid());
+       assert(sz>=0 && sz < maxlen);
 
        err = symlink(lock_info_str, lfname);
        if (err != 0 && errno == EEXIST && force) {
@@ -294,6 +297,7 @@ void lock_file(Lisp_Object fn)
        struct gcpro gcpro1, gcpro2, gcpro3;
        Lisp_Object old_current_buffer;
        Lisp_Object subject_buf;
+       int sz;
 
        if (inhibit_clash_detection)
                return;
@@ -329,8 +333,10 @@ void lock_file(Lisp_Object fn)
        /* Else consider breaking the lock */
        locker = (char *)alloca(strlen(lock_info.user) + strlen(lock_info.host)
                                + LOCK_PID_MAX + 9);
-       sprintf(locker, "%s@%s (pid %lu)", lock_info.user, lock_info.host,
-               lock_info.pid);
+       sz = snprintf(locker, sizeof(locker), "%s@%s (pid %lu)", 
+                     lock_info.user, lock_info.host,
+                     lock_info.pid);
+       assert(sz>=0 && sz < sizeof(locker));
        FREE_LOCK_INFO(lock_info);
 
        attack = call2_in_buffer(BUFFERP(subject_buf) ? XBUFFER(subject_buf) :
index c30043f..ce6d3ad 100644 (file)
@@ -206,7 +206,8 @@ int fd, value;
 
        if ((value < -10) || (value > 18)) {
                char buf[255];
-               sprintf(buf, "sst_set_ger: GER %d out of range", value);
+               int sz = snprintf(buf, sizeof(buf), "sst_set_ger: GER %d out of range", value);
+               assert(sz >= 0 && sz < sizeof(buf));
                warn(buf);
                return;
        }
@@ -237,7 +238,8 @@ int fd, value;
 
        if ((value < -18) || (value > 12)) {
                char buf[255];
-               sprintf(buf, "sst_set_gr: GR %d out of range", value);
+               int sz = sprintf(buf, sizeof(buf), "sst_set_gr: GR %d out of range", value);
+               assert(sz >= 0 && sz < sizeof(buf));
                warn(buf);
                return;
        }
@@ -267,7 +269,8 @@ int fd, value;
        char buf[255];
 
        if ((value < -18) || (value > 12)) {
-               sprintf(buf, "sst_set_gx: GX %d out of range", value);
+               int sz = snprintf(buf, sizeof(buf), "sst_set_gx: GX %d out of range", value);
+               assert(sz >= 0 && sz < sizeof(buf));
                warn(buf);
                return;
        }
@@ -306,7 +309,9 @@ int fd, dhz1, dhz2, thz, rhz, usec;
        else {
                dval1 = (dhz1 * 128 + 63) / 1000;
                if ((dval1 < 1) || (dval1 > 255)) {
-                       sprintf(buf, "sst_tones: dhz1 %d out of range", dhz1);
+                       int sz = snprintf(buf, sizeof(buf), 
+                                         "sst_tones: dhz1 %d out of range", dhz1);
+                       assert(sz >= 0 && sz < sizeof(buf));
                        warn(buf);
                        return;
                }
@@ -317,7 +322,9 @@ int fd, dhz1, dhz2, thz, rhz, usec;
        else {
                dval2 = (dhz2 * 128 + 63) / 1000;
                if ((dval2 < 1) || (dval2 > 255)) {
-                       sprintf(buf, "sst_tones: dhz2 %d out of range", dhz2);
+                       int sz = snprintf(buf, sizeof(buf),
+                                         "sst_tones: dhz2 %d out of range", dhz2);
+                       assert(sz >= 0 && sz < sizeof(buf));
                        warn(buf);
                        return;
                }
@@ -328,7 +335,9 @@ int fd, dhz1, dhz2, thz, rhz, usec;
        else {
                tval = (thz * 128 + 63) / 2000;
                if ((tval < 1) || (tval > 255)) {
-                       sprintf(buf, "sst_tones: thz %d out of range", thz);
+                       int sz = snprintf(buf, sizeof(buf),
+                                         "sst_tones: thz %d out of range", thz);
+                       assert(sz >= 0 && sz < sizeof(buf));
                        warn(buf);
                        return;
                }
@@ -339,24 +348,28 @@ int fd, dhz1, dhz2, thz, rhz, usec;
        else {
                rval = (rhz * 128 + 63) / 2000;
                if ((rval < 1) || (rval > 255)) {
-                       sprintf(buf, "sst_tones: rhz %d out of range", dhz2);
+                       int sz = snprintf(buf, sizeof(buf),
+                                         "sst_tones: rhz %d out of range", dhz2);
+                       assert(sz >= 0 && sz < sizeof(buf));
                        warn(buf);
                        return;
                }
        }
 
        if ((dval1 != 0 || dval2 != 0) && (tval != 0 || rval != 0)) {
-               sprintf(buf,
-                       "sst_tones: cannot use DTMF and TONE or RINGER at the same time",
-                       dhz2);
+               int sz = snprintf(buf, sizeof(buf),
+                                 "sst_tones: cannot use DTMF and TONE or RINGER "
+                                 "at the same time",  dhz2);
+               assert(sz >= 0 && sz < sizeof(buf));
                warn(buf);
                return;
        }
 
        if (tval != 0 && rval != 0) {
-               sprintf(buf,
-                       "sst_tones: cannot use TONE and RINGER at the same time",
-                       dhz2);
+               int sz = sprintf(buf, sizeof(buf),
+                                "sst_tones: cannot use TONE and RINGER at the same time",
+                                dhz2);
+               assert(sz >= 0 && sz < sizeof(buf));
                warn(buf);
                return;
        }
@@ -482,9 +495,10 @@ char *dial;
                default:
                        {
                                char buf[255];
-                               sprintf(buf,
-                                       "sst_dtmf: unknown dialing code '%c'",
-                                       *cp);
+                               int sz = snprintf(buf, sizeof(buf),
+                                                 "sst_dtmf: unknown dialing code '%c'",
+                                                 *cp);
+                               assert(sz >= 0 && sz < sizeof(buf));
                                warn(buf);
                        }
                }
index 148c463..c7cadba 100644 (file)
@@ -3262,7 +3262,7 @@ void write_string_1(const Bufbyte *, Bytecount, Lisp_Object);
 void print_cons(Lisp_Object, Lisp_Object, int);
 void print_vector(Lisp_Object, Lisp_Object, int);
 void print_string(Lisp_Object, Lisp_Object, int);
-char *long_to_string(char *, long);
+char *long_to_string(char *, long, int);
 void print_internal(Lisp_Object, Lisp_Object, int);
 void print_symbol(Lisp_Object, Lisp_Object, int);
 /* The number of bytes required to store the decimal printed
index f726f6f..0c71f30 100644 (file)
@@ -293,8 +293,9 @@ sound_arts_play(audio_job_t aj)
 
        /* trigger arts */
        if (arts_init() == 0) {
-               char tmp[16];
-               snprintf(tmp, 15, "SXEmacs%lx", pthread_self());
+               char tmp[48];
+               int sz = snprintf(tmp, sizeof(tmp), "SXEmacs%lx", pthread_self());
+               assert(sz>=0 && sz<sizeof(tmp));
                sasd->as = arts_play_stream(sasd->mtap->samplerate,
                                            16 /* HARDCODED */,
                                            sasd->mtap->channels, tmp);
index efb2932..5977b3d 100644 (file)
@@ -176,11 +176,8 @@ sound_nas_print(Lisp_Object device, Lisp_Object pcfun, int ef)
        write_c_string(" :server-handle ", pcfun);
        if (snd->aud == NULL)
                write_c_string("#b0rked", pcfun);
-       else {
-               char *tmp = alloca(32);
-               snprintf(tmp, 31, "0x%x", (unsigned int)snd->aud);
-               write_c_string(tmp, pcfun);
-       }
+       else 
+               write_fmt_str(pcfun, "0x%x", (unsigned int)snd->aud);
 
        return;
 }
index 335585d..6b941f5 100644 (file)
@@ -122,12 +122,8 @@ static void
 print_audio_job(worker_job_t job, Lisp_Object pcf)
 {
        audio_job_t aj = audio_job(job);
-       char *str = alloca(64);
-
        SXE_MUTEX_LOCK(&aj->mtx);
-       write_c_string(" carrying ", pcf);
-       snprintf(str, 63, " #<audio-job 0x%lx>", (long unsigned int)aj);
-       write_c_string(str, pcf);
+       write_fmt_string(pcf, " carrying  #<audio-job 0x%lx>", (long unsigned int)aj);
        SXE_MUTEX_UNLOCK(&aj->mtx);
        return;
 }
index 56a3db4..95a1866 100644 (file)
@@ -1934,12 +1934,13 @@ ccl_driver(struct ccl_program *ccl,
                   specified and we still have a room to store the message
                   there.  */
                char msg[256];
-
+               int sz;
                switch (ccl->status) {
                case CCL_STAT_INVALID_CMD:
-                       sprintf(msg,
-                               "\nCCL: Invalid command %x (ccl_code = %x) at %d.",
-                               code & 0x1F, code, this_ic);
+                       sz = snprintf(msg, sizeof(msg),
+                                    "\nCCL: Invalid command %x (ccl_code = %x) at %d.",
+                                    code & 0x1F, code, this_ic);
+                       assert(sz >= 0 && sz < sizeof(msg));
 #ifdef CCL_DEBUG
                        {
                                int i = ccl_backtrace_idx - 1;
@@ -1955,8 +1956,9 @@ ccl_driver(struct ccl_program *ccl,
                                                i = CCL_DEBUG_BACKTRACE_LEN - 1;
                                        if (ccl_backtrace_table[i] == 0)
                                                break;
-                                       sprintf(msg, " %d",
-                                               ccl_backtrace_table[i]);
+                                       sz = snprintf(msg, sizeof(msg), " %d",
+                                                     ccl_backtrace_table[i]);
+                                       assert(sz >= 0 && sz < sizeof(msg));
                                        Dynarr_add_many(destination,
                                                        (unsigned char *)msg,
                                                        strlen(msg));
@@ -1967,12 +1969,14 @@ ccl_driver(struct ccl_program *ccl,
                        break;
 
                case CCL_STAT_QUIT:
-                       sprintf(msg, "\nCCL: Exited.");
+                       sz = snprintf(msg, sizeof(msg), "\nCCL: Exited.");
+                       assert(sz >= 0 && sz < sizeof(msg));
                        break;
 
                default:
-                       sprintf(msg, "\nCCL: Unknown error type (%d).",
-                               ccl->status);
+                       sz = snprintf(msg, sizeof(msg), "\nCCL: Unknown error type (%d).",
+                                     ccl->status);
+                       assert(sz >= 0 && sz < sizeof(msg));
                }
 
                Dynarr_add_many(destination, (unsigned char *)msg, strlen(msg));
index 0da4753..1901c3a 100644 (file)
@@ -46,12 +46,10 @@ static void
 print_opaque(Lisp_Object obj, Lisp_Object printcharfun, int escapeflag)
 {
        const Lisp_Opaque *p = XOPAQUE(obj);
-       char buf[200];
 
-       sprintf(buf,
-               "#<INTERNAL OBJECT (SXEmacs bug?) (opaque, size=%lu) 0x%lx>",
-               (long)(p->size), (unsigned long)p);
-       write_c_string(buf, printcharfun);
+       write_fmt_str(printcharfun,
+                     "#<INTERNAL OBJECT (SXEmacs bug?) (opaque, size=%lu) 0x%lx>",
+                     (long)(p->size), (unsigned long)p);
 }
 
 static inline size_t
@@ -130,12 +128,10 @@ static void
 print_opaque_ptr(Lisp_Object obj, Lisp_Object printcharfun, int escapeflag)
 {
        const Lisp_Opaque_Ptr *p = XOPAQUE_PTR(obj);
-       char buf[200];
-
-       sprintf(buf,
-               "#<INTERNAL OBJECT (SXEmacs bug?) "
-               "(opaque-ptr, adr=%p) %p>", p->ptr, p);
-       write_c_string(buf, printcharfun);
+       
+       write_fmt_string(printcharfun,
+                        "#<INTERNAL OBJECT (SXEmacs bug?) "
+                        "(opaque-ptr, adr=%p) %p>", p->ptr, p);
 }
 
 static int equal_opaque_ptr(Lisp_Object obj1, Lisp_Object obj2, int depth)
index 2698834..309a72b 100644 (file)
@@ -1812,7 +1812,6 @@ mark_evp_pkey(Lisp_Object obj)
 static void
 print_evp_pkey(Lisp_Object obj, Lisp_Object printcharfun, int escapeflag)
 {
-       char buf[256];
        EVP_PKEY *pkey;
        X509 *x509;
 
@@ -1850,8 +1849,7 @@ print_evp_pkey(Lisp_Object obj, Lisp_Object printcharfun, int escapeflag)
                        write_c_string(" empty key", printcharfun); 
 
                if (EVP_PKEY_size(pkey) > 0) {
-                       snprintf(buf, 256, ", size %d", EVP_PKEY_size(pkey)*8);
-                       write_c_string(buf, printcharfun); 
+                       write_fmt_str(printcharfun, ", size %d", EVP_PKEY_size(pkey)*8);
                }
        }
 
index 17c2fa8..18b2884 100644 (file)
@@ -918,18 +918,19 @@ Lisp_Object Vfloat_output_format;
  * re-writing _doprnt to be more sane)?
  *                     -wsr
  */
-void float_to_string(char *buf, fpfloat data)
+void float_to_string(char *buf, fpfloat data, int maxlen)
 {
        Bufbyte *cp, c;
-       int width;
+       int width, sz;
 
        if (NILP(Vfloat_output_format) || !STRINGP(Vfloat_output_format)) {
        lose:
 #if fpfloat_double_p
-               sprintf(buf, "%.16g", data);
+               sz = snprintf(buf, maxlen, "%.16g", data);
 #elif fpfloat_long_double_p
-               sprintf(buf, "%.16Lg", data);
+               sz = snprintf(buf, maxlen, "%.16Lg", data);
 #endif
+               assert(sz>=0 && sz<maxlen);
        } else {                        /* oink oink */
 
                /* Check that the spec we have is fully valid.
@@ -958,7 +959,9 @@ void float_to_string(char *buf, fpfloat data)
                if (cp[1] != 0)
                        goto lose;
 
-               sprintf(buf, (char *)XSTRING_DATA(Vfloat_output_format), data);
+               sz = snprintf(buf, maxlen,
+                             (char *)XSTRING_DATA(Vfloat_output_format), data);
+               assert(sz>=0 && sz < maxlen);
        }
 
        /* added by jwz: don't allow "1.0" to print as "1"; that destroys
@@ -969,14 +972,19 @@ void float_to_string(char *buf, fpfloat data)
        {
                Bufbyte *s = (Bufbyte *) buf;   /* don't use signed chars here!
                                                   isdigit() can't hack them! */
-               if (*s == '-')
+               if (*s == '-') {
                        s++;
+                       maxlen--;
+                       assert(maxlen>0);
+               }
                for (; *s; s++)
                        /* if there's a non-digit, then there is a decimal point, or
                           it's in exponential notation, both of which are ok. */
                        if (!isdigit(*s))
                                goto DONE_LABEL;
                /* otherwise, we need to hack it. */
+               maxlen-=2;
+               assert(maxlen>0);
                *s++ = '.';
                *s++ = '0';
                *s = 0;
@@ -985,6 +993,7 @@ void float_to_string(char *buf, fpfloat data)
 
        /* Some machines print "0.4" as ".4".  I don't like that. */
        if (buf[0] == '.' || (buf[0] == '-' && buf[1] == '.')) {
+               assert(maxlen>0);
                int i;
                for (i = strlen(buf) + 1; i >= 0; i--)
                        buf[i + 1] = buf[i];
@@ -999,11 +1008,12 @@ void float_to_string(char *buf, fpfloat data)
    BUFFER should accept 24 bytes.  This should suffice for the longest
    numbers on 64-bit machines, including the `-' sign and the trailing
    '\0'.  Returns a pointer to the trailing '\0'. */
-char *long_to_string(char *buffer, long number)
+char *long_to_string(char *buffer, long number, int maxlen)
 {
 #if (SIZEOF_LONG != 4) && (SIZEOF_LONG != 8)
        /* Huh? */
-       sprintf(buffer, "%ld", number);
+       int sz = snprintf(buffer, maxlen, "%ld", number);
+       assert(sz>=0 && sz < maxlen);
        return buffer + strlen(buffer);
 #else                          /* (SIZEOF_LONG == 4) || (SIZEOF_LONG == 8) */
        char *p = buffer;
@@ -1013,10 +1023,16 @@ char *long_to_string(char *buffer, long number)
                *p++ = '-';
                number = -number;
        }
-#define FROB(figure) do {                                              \
-    if (force || number >= figure)                                     \
-      *p++ = number / figure + '0', number %= figure, force = 1;       \
-    } while (0)
+#define FROB(figure) \
+       do {                                                            \
+               if (force || number >= figure) {                        \
+                       *p++ = number / figure + '0';                   \
+                       number %= figure;                               \
+                       force = 1;                                      \
+                       --maxlen;                                       \
+                       assert(maxlen>0);                               \
+               }                                                       \
+       } while (0)
 #if SIZEOF_LONG == 8
        FROB(1000000000000000000L);
        FROB(100000000000000000L);
@@ -1314,7 +1330,7 @@ print_internal(Lisp_Object obj, Lisp_Object printcharfun, int escapeflag)
                        if (EQ(obj, being_printed[i])) {
                                char buf[32];
                                *buf = '#';
-                               long_to_string(buf + 1, i);
+                               long_to_string(buf + 1, i, sizeof(buf)-1);
                                write_c_string(buf, printcharfun);
                                return;
                        }
@@ -1333,7 +1349,7 @@ print_internal(Lisp_Object obj, Lisp_Object printcharfun, int escapeflag)
                /* ASCII Decimal representation uses 2.4 times as many bits as
                   machine binary.  */
                char buf[3 * sizeof(EMACS_INT) + 5];
-               long_to_string(buf, XINT(obj));
+               long_to_string(buf, XINT(obj),sizeof(buf));
                write_c_string(buf, printcharfun);
                break;
        }
index 00139b7..1af232f 100644 (file)
@@ -370,10 +370,13 @@ static int allocate_pty_the_old_fashioned_way(void)
 #endif                         /* PTY_ITERATION */
 
                {
+                       int sz;
+
 #ifdef PTY_NAME_SPRINTF
-                       PTY_NAME_SPRINTF
+                       PTY_NAME_SPRINTF;
 #else
-                       sprintf(pty_name, "/dev/pty%c%x", c, i);
+                       sz = snprintf(pty_name, sizeof(pty_name), "/dev/pty%c%x", c, i);
+                       assert(sz >= 0 && sz < sizeof(pty_name));
 #endif                         /* no PTY_NAME_SPRINTF */
 
                        if (sxemacs_stat(pty_name, &stb) < 0) {
@@ -386,9 +389,11 @@ static int allocate_pty_the_old_fashioned_way(void)
 
                        if (fd >= 0) {
 #ifdef PTY_TTY_NAME_SPRINTF
-                               PTY_TTY_NAME_SPRINTF
+                               PTY_TTY_NAME_SPRINTF;
 #else
-                               sprintf(pty_name, "/dev/tty%c%x", c, i);
+                               int sz = snprintf(pty_name, sizeof(pty_name),
+                                                 "/dev/tty%c%x", c, i);
+                               assert(sz >= 0 && sz < sizeof(pty_name));
 #endif                         /* no PTY_TTY_NAME_SPRINTF */
                                if (access(pty_name, R_OK | W_OK) == 0) {
                                        setup_pty(fd);
@@ -1667,8 +1672,9 @@ unix_open_network_stream(Lisp_Object name, Lisp_Object host,
                 * Convert to a C string for later use by getaddrinfo.
                 */
                if (INTP(service)) {
-                       snprintf(portbuf, sizeof(portbuf), "%ld",
-                                (long)XINT(service));
+                       int sz= snprintf(portbuf, sizeof(portbuf), "%ld",
+                                        (long)XINT(service));
+                       assert(sz >= 0 && sz < sizeof(portbuf));
                        portstring = portbuf;
                        port = htons((unsigned short)XINT(service));
                } else {
@@ -2118,8 +2124,9 @@ unix_open_network_server_stream(Lisp_Object name, Lisp_Object host,
                 * Convert to a C string for later use by getaddrinfo.
                 */
                if (INTP(service)) {
-                       snprintf(portbuf, sizeof(portbuf), "%ld",
-                                (long)XINT(service));
+                       int sz = snprintf(portbuf, sizeof(portbuf), "%ld",
+                                         (long)XINT(service));
+                       assert(sz >= 0 && sz < sizeof(portbuf));
                        portstring = portbuf;
                        port = htons((unsigned short)XINT(service));
                } else {
index 1814339..ee0523e 100644 (file)
@@ -157,12 +157,22 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>. */
 #define SHORT_CAST_BUG
 
 /* This is how to get the device name of the tty end of a pty.  */
-#define PTY_TTY_NAME_SPRINTF \
-            sprintf (pty_name, "/dev/pty/tty%c%x", c, i);
+#define PTY_TTY_NAME_SPRINTF                                           \
+       do {                                                            \
+               int sz = snprintf (pty_name, sizeof(pty_name),          \
+                                  "/dev/pty/tty%c%x", c, i);           \
+               assert(sz>=0 && sz<sizeof(pty_name));                   \
+       } while(0)
+
+               
 
 /* This is how to get the device name of the control end of a pty.  */
-#define PTY_NAME_SPRINTF \
-       sprintf (pty_name, "/dev/ptym/pty%c%x", c, i);
+#define PTY_NAME_SPRINTF                                       \
+       do {                                                    \
+               int sz = snprintf (pty_name, sizeof(pty_name),  \
+                                  "/dev/ptym/pty%c%x", c, i);  \
+               assert(sz>=0 && sz<sizeof(pty_name));           \
+       } while(0)
 
 /* This triggers a conditional in xfaces.c.  */
 #define XOS_NEEDS_TIME_H
index bbc6c18..624b0fd 100644 (file)
@@ -80,12 +80,20 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>. */
 #define fsync(x) 0             /* "Comment out" fsync calls */
 
 /* This is how to get the device name of the tty end of a pty.  */
-#define PTY_TTY_NAME_SPRINTF \
-            sprintf (pty_name, "/dev/ttyp%x", i);
+#define PTY_TTY_NAME_SPRINTF                                   \
+       do {                                                    \
+               int sz = snprintf (pty_name, sizeof(pty_name),  \
+                                  "/dev/ttyp%x", i);           \
+               assert(sz>=0 && sz<sizeof(pty_name));           \
+       } while(0)
 
 /* This is how to get the device name of the control end of a pty.  */
-#define PTY_NAME_SPRINTF \
-       sprintf (pty_name, "/dev/pty%x", i);
+#define PTY_NAME_SPRINTF                                       \
+       do {                                                    \
+               int sz = snprintf (pty_name, sizeof(pty_name),  \
+                                  "/dev/pty%x", i);            \
+               assert(sz>=0 && sz<sizeof(pty_name));           \
+       } while(0)
 
 /* Formerly "BSD_PGRPS" */
 
index 842c8e8..44df302 100644 (file)
@@ -46,10 +46,19 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>. */
 
 #define PTY_ITERATION \
    for (i = 0; ; i++)
-#define PTY_NAME_SPRINTF \
-  sprintf (pty_name, "/dev/ptyp%d", i);
-#define PTY_TTY_NAME_SPRINTF \
-  sprintf (pty_name, "/dev/ttyp%d", i);
+#define PTY_NAME_SPRINTF                                      \
+       do {                                                   \
+               int sz = snprintf (pty_name, sizeof(pty_name), \
+                                  "/dev/ptyp%d", i);          \
+               assert(sz>=0 && sz<sizeof(pty_name));          \
+       } while(0)
+
+#define PTY_TTY_NAME_SPRINTF                                   \
+       do {                                                    \
+               int sz = snprintf (pty_name, sizeof(pty_name),  \
+                                  "/dev/ttyp%d", i);           \
+               assert(sz>=0 && sz<sizeof(pty_name));           \
+       } while(0)
 
 /* Must use 'cc' to link when build with motif toolkit. */
 #ifndef __GNUC__
index df5c43b..407f1b7 100644 (file)
@@ -38,11 +38,21 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>. */
 /* SCO has ptys, but with weird names */
 #define HAVE_PTYS
 #define PTY_ITERATION \
-   for (i = 0; ; i++)
-#define PTY_NAME_SPRINTF \
-  sprintf (pty_name, "/dev/ptyp%d", i);
-#define PTY_TTY_NAME_SPRINTF \
-  sprintf (pty_name, "/dev/ttyp%d", i);
+       for (i = 0; ; i++)
+#define PTY_NAME_SPRINTF                                       \
+       do {                                                    \
+               int sz = snprintf (pty_name, sizeof(pty_name),  \
+                                  "/dev/ptyp%d", i);           \
+               assert(sz>=0 && sz<sizeof(pty_name));           \
+       } while(0)
+
+#define PTY_TTY_NAME_SPRINTF                                   \
+       do {                                                    \
+               int sz = snprintf (pty_name, sizeof(pty_name),  \
+                                  "/dev/ttyp%d", i);           \
+               assert(sz>=0 && sz<sizeof(pty_name));           \
+       } while(0)
+
 #define FORCE_ALLOCATE_PTY_THE_OLD_FASHIONED_WAY
 
 /* We have sockets. Always. */
index 8fac3dc..6f94d55 100644 (file)
@@ -185,7 +185,8 @@ static int add_num_time_t(char *string, int max, time_t num)
 
        if (sizeof(num) > 16)
                abort();
-       sprintf(buf, "%lu", (unsigned long)num);
+       length = snprintf(buf, sizeof(buf), "%lu", (unsigned long)num);
+       assert(length >= 0 && length<sizeof(buf));
        length = add_str(string, buf, max);
        return length;
 }
index d5c1740..fff6d46 100644 (file)
@@ -1238,11 +1238,9 @@ void
 print_symbol_value_magic(Lisp_Object obj,
                         Lisp_Object printcharfun, int escapeflag)
 {
-       char buf[200];
-       sprintf(buf, "#<INTERNAL OBJECT (SXEmacs bug?) (%s type %d) 0x%lx>",
-               XRECORD_LHEADER_IMPLEMENTATION(obj)->name,
-               XSYMBOL_VALUE_MAGIC_TYPE(obj), (long)XPNTR(obj));
-       write_c_string(buf, printcharfun);
+       write_fmt_str( printcharfun, "#<INTERNAL OBJECT (SXEmacs bug?) (%s type %d) 0x%lx>",
+                      XRECORD_LHEADER_IMPLEMENTATION(obj)->name,
+                      XSYMBOL_VALUE_MAGIC_TYPE(obj), (long)XPNTR(obj));
 }
 
 static const struct lrecord_description symbol_value_forward_description[] = {
index 2ea5840..12da833 100644 (file)
@@ -6580,7 +6580,7 @@ static char *window_line_number(struct window *w, int type)
 
        line = buffer_line_number(b, pos, 1);
 
-       long_to_string(window_line_number_buf, line + 1);
+       long_to_string(window_line_number_buf, line + 1, sizeof(window_line_number_buf));
 
        return window_line_number_buf;
 }
@@ -6627,7 +6627,7 @@ static void decode_mode_spec(struct window *w, Emchar spec, int type)
                                        1) + !!column_number_start_at_one;
                char buf[sizeof(long)*3+1];
 
-               long_to_string(buf, col);
+               long_to_string(buf, col, sizeof(buf));
 
                Dynarr_add_many(mode_spec_bufbyte_string,
                                (const Bufbyte *)buf, strlen(buf));