sprintf->snprintf. miod@, grange@ ok.

3 files changed, 14 insertions, 12 deletions

diff --git a/sys/dev/ata/ata.c b/sys/dev/ata/ata.c
index 485a481e2e9..ef1a23776f1 100644
--- a/sys/dev/ata/ata.c
+++ b/sys/dev/ata/ata.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: ata.c,v 1.16 2003/02/28 19:22:37 grange Exp $      */
+/*      $OpenBSD: ata.c,v 1.17 2003/04/09 00:38:07 ho Exp $      */
 /*      $NetBSD: ata.c,v 1.9 1999/04/15 09:41:09 bouyer Exp $      */
 /*
  * Copyright (c) 1998, 2001 Manuel Bouyer.  All rights reserved.
@@ -206,10 +206,7 @@ ata_dmaerr(drvp)
 }
 
 void
-ata_perror(drvp, errno, buf)
-	struct ata_drive_datas *drvp;
-	int errno;
-	char *buf;
+ata_perror(struct ata_drive_datas *drvp, int errno, char *buf, size_t buf_len)
 {
 	static char *errstr0_3[] = {"address mark not found",
 	    "track 0 not found", "aborted command", "media change requested",
@@ -222,6 +219,7 @@ ata_perror(drvp, errno, buf)
 	char **errstr;
 	int i;
 	char *sep = "";
+	size_t len = 0;
 
 	if (drvp->ata_vers >= 4)
 		errstr = errstr4_5;
@@ -229,12 +227,14 @@ ata_perror(drvp, errno, buf)
 		errstr = errstr0_3;
 
 	if (errno == 0) {
-		sprintf(buf, "error not notified");
+		snprintf(buf, buf_len, "error not notified");
 	}
 
 	for (i = 0; i < 8; i++) {
 		if (errno & (1 << i)) {
-			buf += sprintf(buf, "%s %s", sep, errstr[i]);
+			snprintf(buf + len, buf_len - len, "%s %s", sep,
+			    errstr[i]);
+			len = strlen(buf);
 			sep = ",";
 		}
 	}
diff --git a/sys/dev/ata/atavar.h b/sys/dev/ata/atavar.h
index 476e0f8623d..e5d36ee0309 100644
--- a/sys/dev/ata/atavar.h
+++ b/sys/dev/ata/atavar.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: atavar.h,v 1.12 2003/02/21 20:10:33 grange Exp $	*/
+/*	$OpenBSD: atavar.h,v 1.13 2003/04/09 00:38:08 ho Exp $	*/
 /*	$NetBSD: atavar.h,v 1.13 1999/03/10 13:11:43 bouyer Exp $	*/
 
 /*
@@ -181,4 +181,4 @@ int ata_set_mode(struct ata_drive_datas*, u_int8_t, u_int8_t);
 #define CMD_AGAIN 2
 
 void ata_dmaerr(struct ata_drive_datas *);
-void ata_perror(struct ata_drive_datas *, int, char *);
+void ata_perror(struct ata_drive_datas *, int, char *, size_t);
diff --git a/sys/dev/ata/wd.c b/sys/dev/ata/wd.c
index f5c52ef6845..080e425c845 100644
--- a/sys/dev/ata/wd.c
+++ b/sys/dev/ata/wd.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: wd.c,v 1.28 2003/04/06 15:28:25 krw Exp $ */
+/*	$OpenBSD: wd.c,v 1.29 2003/04/09 00:38:08 ho Exp $ */
 /*	$NetBSD: wd.c,v 1.193 1999/02/28 17:15:27 explorer Exp $ */
 
 /*
@@ -646,7 +646,8 @@ wddone(v)
 		if (wd->sc_wdc_bio.r_error != 0 &&
 		    (wd->sc_wdc_bio.r_error & ~(WDCE_MC | WDCE_MCR)) == 0)
 			goto noerror;
-		ata_perror(wd->drvp, wd->sc_wdc_bio.r_error, errbuf);
+		ata_perror(wd->drvp, wd->sc_wdc_bio.r_error, errbuf,
+		    sizeof buf);
 retry:
 		/* Just reset and retry. Can we do more ? */
 		wdc_reset_channel(wd->drvp);
@@ -1223,7 +1224,8 @@ again:
 			break;
 		case ERROR:
 			errbuf[0] = '\0';
-			ata_perror(wd->drvp, wd->sc_wdc_bio.r_error, errbuf);
+			ata_perror(wd->drvp, wd->sc_wdc_bio.r_error, errbuf,
+			    sizeof errbuf);
 			printf("wddump: %s", errbuf);
 			err = EIO;
 			break;