Nalin Dahyabhai's fix for sink.c/transact.c to reserve sufficient

space for \r\n trailers in snprintf calls. Sent by Miloslav Trmac,
possibly fixing Red Hat bug #114470.

svn path=/trunk/; revision=4071

diff --git a/NEWS b/NEWS
index 3b4c55647e47367e502da9093662a0c8fef263ca..a0103ce2ffacc86d90f0111408e998da171173e9 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -80,6 +80,9 @@ fetchmail 6.3.0 (not yet released officially):
   sizeof(int) != sizeof(size_t). (Matthias Andree)
 * Nalin Dahyabhai's fix for driver.c to not call the private Kerberos
   krb5_init_ets() function. Sent by Miloslav Trmac. (Matthias Andree)
+* Nalin Dahyabhai's fix for sink.c/transact.c to reserve sufficient
+  space for \r\n trailers in snprintf calls. Sent by Miloslav Trmac,
+  possibly fixing Red Hat bug #114470. (Matthias Andree).
 
 fetchmail-6.2.5 (Wed Oct 15 18:39:22 EDT 2003), 23079 lines:
 

diff --git a/sink.c b/sink.c
index 68a1739b8c5a43b98b0d8711eb84186af1a9a59d..59c4fab7c25c5b1109a8cc57ec0c9980b7a62a81 100644 (file)
--- a/sink.c
+++ b/sink.c
@@ -1540,7 +1540,7 @@ va_dcl
 #else
     va_start(ap);
 #endif
-    vsnprintf(buf, sizeof(buf), fmt, ap);
+    vsnprintf(buf, sizeof(buf) - 2, fmt, ap);
     va_end(ap);
 
     snprintf(buf+strlen(buf), sizeof(buf)-strlen(buf), "\r\n");

diff --git a/transact.c b/transact.c
index f9328df2e64f0fa5c5b760fd5f8eb662d19f096f..85cf0f38a3bcf5923d254d5783d19259eda21a02 100644 (file)
--- a/transact.c
+++ b/transact.c
@@ -1413,7 +1413,7 @@ va_dcl
     va_list ap;
 
     if (protocol->tagged && !suppress_tags)
-       (void) sprintf(buf, "%s ", GENSYM);
+        snprintf(buf, sizeof(buf) - 2, "%s ", GENSYM);
     else
        buf[0] = '\0';
 
@@ -1422,7 +1422,7 @@ va_dcl
 #else
     va_start(ap);
 #endif
-    vsnprintf(buf + strlen(buf), sizeof(buf)-strlen(buf), fmt, ap);
+    vsnprintf(buf + strlen(buf), sizeof(buf)-2-strlen(buf), fmt, ap);
     va_end(ap);
 
     snprintf(buf+strlen(buf), sizeof(buf)-strlen(buf), "\r\n");
@@ -1490,7 +1490,7 @@ va_dcl
     phase = SERVER_WAIT;
 
     if (protocol->tagged && !suppress_tags)
-       (void) sprintf(buf, "%s ", GENSYM);
+       snprintf(buf, sizeof(buf) - 2, "%s ", GENSYM);
     else
        buf[0] = '\0';
 
@@ -1499,7 +1499,7 @@ va_dcl
 #else
     va_start(ap);
 #endif
-    vsnprintf(buf + strlen(buf), sizeof(buf)-strlen(buf), fmt, ap);
+    vsnprintf(buf + strlen(buf), sizeof(buf)-2-strlen(buf), fmt, ap);
     va_end(ap);
 
     snprintf(buf+strlen(buf), sizeof(buf)-strlen(buf), "\r\n");