changed to use slprintf() instead of sprintf() just about

everywhere. I've implemented slprintf() as a bounds checked sprintf()
using mprotect() and a non-writeable page.

This should prevent any sprintf based security holes.
(This used to be commit ee09e9dadb69aaba5a751dd20ccc6d587d841bd6)

1 files changed, 8 insertions, 8 deletions

diff --git a/source3/nmbd/nmbd_serverlistdb.c b/source3/nmbd/nmbd_serverlistdb.c
index ea1948cece..64ca49cdbc 100644
--- a/source3/nmbd/nmbd_serverlistdb.c
+++ b/source3/nmbd/nmbd_serverlistdb.c
@@ -365,10 +365,10 @@ void write_browse_list(time_t t, BOOL force_write)
     return;
   }
 
-  sprintf(tmp, "\"%s\"", work->work_group);
+  slprintf(tmp,sizeof(tmp)-1, "\"%s\"", work->work_group);
   fprintf(fp, "%-25s ", tmp);
   fprintf(fp, "%08x ", SV_TYPE_DOMAIN_ENUM|SV_TYPE_NT|SV_TYPE_LOCAL_LIST_ONLY);
-  sprintf(tmp, "\"%s\" ", work->local_master_browser_name);
+  slprintf(tmp, sizeof(tmp)-1, "\"%s\" ", work->local_master_browser_name);
   fprintf(fp, "%-30s", tmp);
   fprintf(fp, "\"%s\"\n", work->work_group);
 
@@ -394,10 +394,10 @@ void write_browse_list(time_t t, BOOL force_write)
     }
 
     /* Output server details, plus what workgroup they're in. */
-    sprintf(tmp, "\"%s\"", my_netbios_names[i]);
+    slprintf(tmp, sizeof(tmp)-1, "\"%s\"", my_netbios_names[i]);
     fprintf(fp, "%-25s ", tmp);
     fprintf(fp, "%08x ", stype);
-    sprintf(tmp, "\"%s\" ", lp_serverstring());
+    slprintf(tmp, sizeof(tmp)-1, "\"%s\" ", lp_serverstring());
     fprintf(fp, "%-30s", tmp);
     fprintf(fp, "\"%s\"\n", global_myworkgroup);
   }
@@ -413,11 +413,11 @@ void write_browse_list(time_t t, BOOL force_write)
 
       if(wg_type)
       {
-        sprintf(tmp, "\"%s\"", work->work_group);
+        slprintf(tmp, sizeof(tmp)-1, "\"%s\"", work->work_group);
         fprintf(fp, "%-25s ", tmp);
 
         fprintf(fp, "%08x ", wg_type);
-        sprintf(tmp, "\"%s\" ", work->local_master_browser_name);
+        slprintf(tmp, sizeof(tmp)-1, "\"%s\" ", work->local_master_browser_name);
         fprintf(fp, "%-30s", tmp);
         fprintf(fp, "\"%s\"\n", work->work_group);
       }
@@ -437,10 +437,10 @@ void write_browse_list(time_t t, BOOL force_write)
         if(serv_type)
         {
           /* Output server details, plus what workgroup they're in. */
-          sprintf(tmp, "\"%s\"", servrec->serv.name);
+          slprintf(tmp, sizeof(tmp)-1, "\"%s\"", servrec->serv.name);
           fprintf(fp, "%-25s ", tmp);
           fprintf(fp, "%08x ", serv_type);
-          sprintf(tmp, "\"%s\" ", servrec->serv.comment);
+          slprintf(tmp, sizeof(tmp)-1, "\"%s\" ", servrec->serv.comment);
           fprintf(fp, "%-30s", tmp);
           fprintf(fp, "\"%s\"\n", work->work_group);
         }