replace strcpy with strlcpy and some strdup.

ok rohee@ tdeval@ dhartmei@
requested by deraadt@

15 files changed, 39 insertions, 40 deletions

diff --git a/usr.sbin/bind/lib/dns/byaddr.c b/usr.sbin/bind/lib/dns/byaddr.c
index 97b93061aab..b173f489a43 100644
--- a/usr.sbin/bind/lib/dns/byaddr.c
+++ b/usr.sbin/bind/lib/dns/byaddr.c
@@ -100,7 +100,7 @@ dns_byaddr_createptrname(isc_netaddr_t *address, isc_boolean_t nibble,
 				*cp++ = hex_digits[(bytes[i] >> 4) & 0x0f];
 				*cp++ = '.';
 			}
-			strcpy(cp, "ip6.int.");
+			strlcpy(cp, "ip6.int.", textname + sizeof(textname) - cp);
 		} else {
 			cp = textname;
 			*cp++ = '\\';
@@ -112,7 +112,7 @@ dns_byaddr_createptrname(isc_netaddr_t *address, isc_boolean_t nibble,
 				*cp++ = hex_digits[(bytes[i+1] >> 4) & 0x0f];
 				*cp++ = hex_digits[bytes[i+1] & 0x0f];
 			}
-			strcpy(cp, "].ip6.arpa.");
+			strlcpy(cp, "].ip6.arpa.", textname + sizeof(textname) - cp);
 		}
 	} else
 		return (ISC_R_NOTIMPLEMENTED);
diff --git a/usr.sbin/bind/lib/dns/master.c b/usr.sbin/bind/lib/dns/master.c
index 2eb54686cc1..4e084bfe55b 100644
--- a/usr.sbin/bind/lib/dns/master.c
+++ b/usr.sbin/bind/lib/dns/master.c
@@ -530,7 +530,7 @@ genname(char *name, int it, char *buffer, size_t length) {
 				isc_textregion_consume(&r, 1);
 				continue;
 			}
-			strcpy(fmt, "%d");
+			strlcpy(fmt, "%d", sizeof(fmt));
 			/* Get format specifier. */
 			if (*name == '{' ) {
 				n = sscanf(name, "{%d,%u,%1[doxX]}",
diff --git a/usr.sbin/bind/lib/dns/name.c b/usr.sbin/bind/lib/dns/name.c
index 73b3aaf3fc8..08c25ff2bb9 100644
--- a/usr.sbin/bind/lib/dns/name.c
+++ b/usr.sbin/bind/lib/dns/name.c
@@ -1808,7 +1808,7 @@ dns_name_totext(dns_name_t *name, isc_boolean_t omit_final_dot,
 			if (count == 0)
 				count = 256;
 			nlen--;
-			len = sprintf(num, "%u", count);	/* XXX */
+			len = snprintf(num, sizeof(num), "%u", count);
 			INSIST(len <= 4);
 			bytes = count / 8;
 			if (count % 8 != 0)
@@ -1961,7 +1961,7 @@ dns_name_tofilenametext(dns_name_t *name, isc_boolean_t omit_final_dot,
 			if (count == 0)
 				count = 256;
 			nlen--;
-			len = sprintf(num, "%u", count);	/* XXX */
+			len = snprintf(num, sizeof(num), "%u", count);
 			INSIST(len <= 4);
 			bytes = count / 8;
 			if (count % 8 != 0)
diff --git a/usr.sbin/bind/lib/dns/tsig.c b/usr.sbin/bind/lib/dns/tsig.c
index fd526054358..ecc9012bfd6 100644
--- a/usr.sbin/bind/lib/dns/tsig.c
+++ b/usr.sbin/bind/lib/dns/tsig.c
@@ -114,7 +114,7 @@ tsig_log(dns_tsigkey_t *key, int level, const char *fmt, ...) {
 	if (key != NULL)
 		dns_name_format(&key->name, namestr, sizeof(namestr));
 	else
-		strcpy(namestr, "<null>");
+		strlcpy(namestr, "<null>", sizeof(namestr));
 	va_start(ap, fmt);
 	vsnprintf(message, sizeof(message), fmt, ap);
 	va_end(ap);
diff --git a/usr.sbin/bind/lib/dns/zone.c b/usr.sbin/bind/lib/dns/zone.c
index 7b4ad73274f..ee3793dbe8e 100644
--- a/usr.sbin/bind/lib/dns/zone.c
+++ b/usr.sbin/bind/lib/dns/zone.c
@@ -826,8 +826,8 @@ default_journal(dns_zone_t *zone) {
 		journal = isc_mem_allocate(zone->mctx, len);
 		if (journal == NULL)
 			return (ISC_R_NOMEMORY);
-		strcpy(journal, zone->masterfile);
-		strcat(journal, ".jnl");
+		strlcpy(journal, zone->masterfile, len);
+		strlcat(journal, ".jnl", len);
 	} else {
 		journal = NULL;
 	}
diff --git a/usr.sbin/bind/lib/isc/inet_ntop.c b/usr.sbin/bind/lib/isc/inet_ntop.c
index 4dd0ed5089e..dc121e6c3f9 100644
--- a/usr.sbin/bind/lib/isc/inet_ntop.c
+++ b/usr.sbin/bind/lib/isc/inet_ntop.c
@@ -86,12 +86,12 @@ inet_ntop4(const unsigned char *src, char *dst, size_t size)
 	static const char *fmt = "%u.%u.%u.%u";
 	char tmp[sizeof "255.255.255.255"];
 
-	if ((size_t)sprintf(tmp, fmt, src[0], src[1], src[2], src[3]) >= size)
+	if ((size_t)snprintf(tmp, sizeof(tmp), fmt, src[0], src[1], src[2], src[3]) >= size)
 	{
 		errno = ENOSPC;
 		return (NULL);
 	}
-	strcpy(dst, tmp);
+	strlcpy(dst, tmp, size);
 
 	return (dst);
 }
@@ -188,7 +188,7 @@ inet_ntop6(const unsigned char *src, char *dst, size_t size)
 		errno = ENOSPC;
 		return (NULL);
 	}
-	strcpy(dst, tmp);
+	strlcpy(dst, tmp, size);
 	return (dst);
 }
 #endif /* AF_INET6 */
diff --git a/usr.sbin/bind/lib/isc/log.c b/usr.sbin/bind/lib/isc/log.c
index 6a57b566602..81cb805fbb4 100644
--- a/usr.sbin/bind/lib/isc/log.c
+++ b/usr.sbin/bind/lib/isc/log.c
@@ -1357,6 +1357,7 @@ isc_log_doit(isc_log_t *lctx, isc_logcategory_t *category,
 	isc_logchannel_t *channel;
 	isc_logchannellist_t *category_channels;
 	isc_result_t result;
+	size_t len;
 
 	REQUIRE(lctx == NULL || VALID_CONTEXT(lctx));
 	REQUIRE(category != NULL);
@@ -1570,16 +1571,17 @@ isc_log_doit(isc_log_t *lctx, isc_logcategory_t *category,
 				 * It wasn't in the duplicate interval,
 				 * so add it to the message list.
 				 */
+				len = strlen(lctx->buffer) + 1;
 				new = isc_mem_get(lctx->mctx,
-						  sizeof(isc_logmessage_t) +
-						  strlen(lctx->buffer) + 1);
+				                  sizeof(isc_logmessage_t)
+						  + len);
 				if (new != NULL) {
 					/*
 					 * Put the text immediately after
 					 * the struct.  The strcpy is safe.
 					 */
 					new->text = (char *)(new + 1);
-					strcpy(new->text, lctx->buffer);
+					strlcpy(new->text, lctx->buffer, len);
 
 					if (isc_time_now(&new->time) !=
 					    ISC_R_SUCCESS)
diff --git a/usr.sbin/bind/lib/isc/unix/dir.c b/usr.sbin/bind/lib/isc/unix/dir.c
index 211ce0393d0..f40ab1ba653 100644
--- a/usr.sbin/bind/lib/isc/unix/dir.c
+++ b/usr.sbin/bind/lib/isc/unix/dir.c
@@ -97,7 +97,7 @@ isc_dir_read(isc_dir_t *dir) {
 	if (sizeof(dir->entry.name) <= strlen(entry->d_name))
 	    return (ISC_R_UNEXPECTED);
 
-	strcpy(dir->entry.name, entry->d_name);
+	strlcpy(dir->entry.name, entry->d_name, sizeof(dir->entry.name));
 
 	/*
 	 * Some dirents have d_namlen, but it is not portable.
@@ -177,7 +177,7 @@ isc_dir_current(char *dirname, size_t length, isc_boolean_t end_sep) {
 		if (strlen(dirname) + 1 == length)
 			result = ISC_R_NOSPACE;
 		else if (dirname[1] != '\0')
-			strcat(dirname, "/");
+			strlcat(dirname, "/", length);
 	}
 
 	return (result);
diff --git a/usr.sbin/bind/lib/isc/unix/file.c b/usr.sbin/bind/lib/isc/unix/file.c
index 1e3d96db95f..95f5428ca43 100644
--- a/usr.sbin/bind/lib/isc/unix/file.c
+++ b/usr.sbin/bind/lib/isc/unix/file.c
@@ -147,12 +147,12 @@ isc_file_template(const char *path, const char *templet, char *buf,
 
 		strncpy(buf, path, s - path + 1);
 		buf[s - path + 1] = '\0';
-		strcat(buf, templet);
+		strlcat(buf, templet, buflen);
 	} else {
 		if ((strlen(templet) + 1) > buflen)
 			return (ISC_R_NOSPACE);
 
-		strcpy(buf, templet);
+		strlcpy(buf, templet, buflen);
 	}
 
 	return (ISC_R_SUCCESS);
@@ -310,6 +310,6 @@ isc_file_absolutepath(const char *filename, char *path, size_t pathlen) {
 		return (result);
 	if (strlen(path) + strlen(filename) + 1 > pathlen)
 		return (ISC_R_NOSPACE);
-	strcat(path, filename);
+	strlcat(path, filename, pathlen);
 	return (ISC_R_SUCCESS);
 }
diff --git a/usr.sbin/bind/lib/isccfg/parser.c b/usr.sbin/bind/lib/isccfg/parser.c
index 84c0a1b7fb3..d793e1546c3 100644
--- a/usr.sbin/bind/lib/isccfg/parser.c
+++ b/usr.sbin/bind/lib/isccfg/parser.c
@@ -2771,9 +2771,9 @@ token_addr(cfg_parser_t *pctx, unsigned int flags, isc_netaddr_t *na) {
 			char buf[64];
 			int i;
 
-			strcpy(buf, s);
+			strlcpy(buf, s, sizeof(buf));
 			for (i = 0; i < 3; i++) {
-				strcat(buf, ".0");
+				strlcat(buf, ".0", sizeof(buf));
 				if (inet_pton(AF_INET, buf, &in4a) == 1) {
 					isc_netaddr_fromin(na, &in4a);
 					return (ISC_R_SUCCESS);
diff --git a/usr.sbin/bind/lib/lwres/getipnode.c b/usr.sbin/bind/lib/lwres/getipnode.c
index ba978a508fa..b6dbbf6b259 100644
--- a/usr.sbin/bind/lib/lwres/getipnode.c
+++ b/usr.sbin/bind/lib/lwres/getipnode.c
@@ -145,7 +145,7 @@ lwres_getipnodebyname(const char *name, int af, int flags, int *error_num) {
 
 		u.const_name = name;
 		if (v4 == 1 && af == AF_INET6) {
-			strcpy(mappedname, "::ffff:");
+			strlcpy(mappedname, "::ffff:", sizeof(mappedname));
 			lwres_net_ntop(AF_INET, (char *)&in4,
 				       mappedname + sizeof("::ffff:") - 1,
 				       sizeof(mappedname) - sizeof("::ffff:")
@@ -533,7 +533,6 @@ copyandmerge(struct hostent *he1, struct hostent *he2, int af, int *error_num)
 	struct hostent *he = NULL;
 	int addresses = 1;	/* NULL terminator */
 	int names = 1;		/* NULL terminator */
-	int len = 0;
 	char **cpp, **npp;
 
 	/*
@@ -642,11 +641,9 @@ copyandmerge(struct hostent *he1, struct hostent *he2, int af, int *error_num)
 	npp = he->h_aliases;
 	cpp = (he1 != NULL) ? he1->h_aliases : he2->h_aliases;
 	while (*cpp != NULL) {
-		len = strlen (*cpp) + 1;
-		*npp = malloc(len);
+		*npp = strdup(*cpp);
 		if (*npp == NULL)
 			goto cleanup2;
-		strcpy(*npp, *cpp);
 		npp++;
 		cpp++;
 	}
@@ -654,11 +651,9 @@ copyandmerge(struct hostent *he1, struct hostent *he2, int af, int *error_num)
 	/*
 	 * Copy hostname.
 	 */
-	he->h_name = malloc(strlen((he1 != NULL) ?
-			    he1->h_name : he2->h_name) + 1);
+	he->h_name = strdup((he1 != NULL) ? he1->h_name : he2->h_name);
 	if (he->h_name == NULL)
 		goto cleanup2;
-	strcpy(he->h_name, (he1 != NULL) ? he1->h_name : he2->h_name);
 
 	/*
 	 * Set address type and length.
diff --git a/usr.sbin/bind/lib/lwres/getnameinfo.c b/usr.sbin/bind/lib/lwres/getnameinfo.c
index df0756adb19..e2aab4dba42 100644
--- a/usr.sbin/bind/lib/lwres/getnameinfo.c
+++ b/usr.sbin/bind/lib/lwres/getnameinfo.c
@@ -175,11 +175,11 @@ lwres_getnameinfo(const struct sockaddr *sa, size_t salen, char *host,
 		snprintf(numserv, sizeof(numserv), "%d", ntohs(port));
 		if ((strlen(numserv) + 1) > servlen)
 			ERR(ENI_MEMORY);
-		strcpy(serv, numserv);
+		strlcpy(serv, numserv, servlen);
 	} else {
 		if ((strlen(sp->s_name) + 1) > servlen)
 			ERR(ENI_MEMORY);
-		strcpy(serv, sp->s_name);
+		strlcpy(serv, sp->s_name, servlen);
 	}
 
 #if 0
@@ -235,7 +235,7 @@ lwres_getnameinfo(const struct sockaddr *sa, size_t salen, char *host,
 #endif
 		if (strlen(numaddr) + 1 > hostlen)
 			ERR(ENI_MEMORY);
-		strcpy(host, numaddr);
+		strlcpy(host, numaddr, hostlen);
 	} else {
 		switch (family) {
 		case AF_INET:
@@ -264,7 +264,7 @@ lwres_getnameinfo(const struct sockaddr *sa, size_t salen, char *host,
 			}
 			if ((strlen(by->realname) + 1) > hostlen)
 				ERR(ENI_MEMORY);
-			strcpy(host, by->realname);
+			strlcpy(host, by->realname, hostlen);
 		} else {
 			if (flags & NI_NAMEREQD)
 				ERR(ENI_NOHOSTNAME);
@@ -274,7 +274,7 @@ lwres_getnameinfo(const struct sockaddr *sa, size_t salen, char *host,
 				ERR(ENI_NOHOSTNAME);
 			if ((strlen(numaddr) + 1) > hostlen)
 				ERR(ENI_MEMORY);
-			strcpy(host, numaddr);
+			strlcpy(host, numaddr, hostlen);
 		}
 	}
 	result = SUCCESS;
diff --git a/usr.sbin/bind/lib/lwres/lwconfig.c b/usr.sbin/bind/lib/lwres/lwconfig.c
index cc96ea0fdbe..8e57396e803 100644
--- a/usr.sbin/bind/lib/lwres/lwconfig.c
+++ b/usr.sbin/bind/lib/lwres/lwconfig.c
@@ -192,13 +192,15 @@ lwres_resetaddr(lwres_addr_t *addr) {
 static char *
 lwres_strdup(lwres_context_t *ctx, const char *str) {
 	char *p;
+	size_t len;
 
 	REQUIRE(str != NULL);
 	REQUIRE(strlen(str) > 0);
 
-	p = CTXMALLOC(strlen(str) + 1);
+	len = strlen(str) + 1;
+	p = CTXMALLOC(len);
 	if (p != NULL)
-		strcpy(p, str);
+		strlcpy(p, str, len);
 
 	return (p);
 }
diff --git a/usr.sbin/bind/lib/lwres/lwinetntop.c b/usr.sbin/bind/lib/lwres/lwinetntop.c
index c9525ec55cf..0f58009031c 100644
--- a/usr.sbin/bind/lib/lwres/lwinetntop.c
+++ b/usr.sbin/bind/lib/lwres/lwinetntop.c
@@ -90,7 +90,7 @@ inet_ntop4(const unsigned char *src, char *dst, size_t size) {
 		errno = ENOSPC;
 		return (NULL);
 	}
-	strcpy(dst, tmp);
+	strlcpy(dst, tmp, size);
 
 	return (dst);
 }
@@ -186,7 +186,7 @@ inet_ntop6(const unsigned char *src, char *dst, size_t size) {
 		errno = ENOSPC;
 		return (NULL);
 	}
-	strcpy(dst, tmp);
+	strlcpy(dst, tmp, size);
 	return (dst);
 }
 #endif /* AF_INET6 */
diff --git a/usr.sbin/bind/lib/lwres/lwresutil.c b/usr.sbin/bind/lib/lwres/lwresutil.c
index c1a76781620..8fc7f00f08d 100644
--- a/usr.sbin/bind/lib/lwres/lwresutil.c
+++ b/usr.sbin/bind/lib/lwres/lwresutil.c
@@ -189,7 +189,7 @@ lwres_getaddrsbyname(lwres_context_t *ctx, const char *name,
 	target_length = strlen(name);
 	if (target_length >= sizeof(target_name))
 		return (LWRES_R_FAILURE);
-	strcpy(target_name, name); /* strcpy is safe */
+	strlcpy(target_name, name, sizeof(target_name));
 
 	/*
 	 * Set up our request and render it to a buffer.
@@ -411,7 +411,7 @@ lwres_getrdatabyname(lwres_context_t *ctx, const char *name,
 	target_length = strlen(name);
 	if (target_length >= sizeof(target_name))
 		return (LWRES_R_FAILURE);
-	strcpy(target_name, name); /* strcpy is safe */
+	strlcpy(target_name, name, sizeof(target_name));
 
 	/*
 	 * Set up our request and render it to a buffer.