use strlcpy/snprintf; deraadt@ OK

3 files changed, 25 insertions, 32 deletions

diff --git a/lib/libocurses/setterm.c b/lib/libocurses/setterm.c
index 73f57edb7a8..adde8a12ecd 100644
--- a/lib/libocurses/setterm.c
+++ b/lib/libocurses/setterm.c
@@ -100,7 +100,7 @@ setterm(type)
 	unknown = 0;
 	if (tgetent(genbuf, type) != 1) {
 		unknown++;
-		strcpy(genbuf, "xx|dumb:");
+		strlcpy(genbuf, "xx|dumb:", sizeof(genbuf));
 	}
 #ifdef DEBUG
 	__CTRACE("setterm: tty = %s\n", type);
diff --git a/lib/libocurses/termcap.c b/lib/libocurses/termcap.c
index c060f7fd4a0..1eb3baf117e 100644
--- a/lib/libocurses/termcap.c
+++ b/lib/libocurses/termcap.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: termcap.c,v 1.6 2000/10/09 22:01:26 millert Exp $	*/
+/*	$OpenBSD: termcap.c,v 1.7 2003/04/04 18:39:12 millert Exp $	*/
 /*	$NetBSD: termcap.c,v 1.7 1995/06/05 19:45:52 pk Exp $	*/
 
 /*
@@ -38,7 +38,7 @@
 #if 0
 static char sccsid[] = "@(#)termcap.c	8.1 (Berkeley) 6/4/93";
 #else
-static char rcsid[] = "$OpenBSD: termcap.c,v 1.6 2000/10/09 22:01:26 millert Exp $";
+static char rcsid[] = "$OpenBSD: termcap.c,v 1.7 2003/04/04 18:39:12 millert Exp $";
 #endif
 #endif /* not lint */
 
@@ -108,17 +108,10 @@ tgetent(bp, name)
 	} else if (!cp || *cp != '/') { /* TERMCAP holds an entry */
 		if ((termpath = getenv("TERMPATH")) != NULL)
 			strlcpy(pathbuf, termpath, sizeof(pathbuf));
-		else {
-			if ((home = getenv("HOME")) != NULL && *home != '\0' &&
-			    strlen(home) + sizeof(_PATH_DEF) <
-			    sizeof(pathbuf)) {
-				sprintf(pathbuf, "%s/%s", home,
-				    _PATH_DEF);
-			} else {
-				strlcpy(pathbuf, _PATH_DEF,
-				    sizeof(pathbuf));
-			}
-		}
+		else if ((home = getenv("HOME")) == NULL || *home == '\0' ||
+		    snprintf(pathbuf, sizeof(pathbuf), "%s/%s", home,
+		    _PATH_DEF) >= sizeof(pathbuf))
+			strlcpy(pathbuf, _PATH_DEF, sizeof(pathbuf));
 	} else {		/* user-defined path in TERMCAP */
 		/* still can be tokenized */
 		strlcpy(pathbuf, cp, sizeof(pathbuf));
@@ -227,7 +220,7 @@ tgetstr(id, area)
 	if ((i = cgetstr(tbuf, ids, &s)) < 0)
 		return NULL;
 	
-	strcpy(*area, s);
+	strlcpy(*area, s, 1024);
 	*area += i + 1;
 	return (s);
 }
diff --git a/lib/libocurses/tgoto.c b/lib/libocurses/tgoto.c
index 5c7a43f9b39..aef10285c8b 100644
--- a/lib/libocurses/tgoto.c
+++ b/lib/libocurses/tgoto.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: tgoto.c,v 1.1 1998/07/23 21:10:28 millert Exp $	*/
+/*	$OpenBSD: tgoto.c,v 1.2 2003/04/04 18:39:12 millert Exp $	*/
 /*	$NetBSD: tgoto.c,v 1.5 1995/06/05 19:45:54 pk Exp $	*/
 
 /*
@@ -38,7 +38,7 @@
 #if 0
 static char sccsid[] = "@(#)tgoto.c	8.1 (Berkeley) 6/4/93";
 #else
-static char rcsid[] = "$OpenBSD: tgoto.c,v 1.1 1998/07/23 21:10:28 millert Exp $";
+static char rcsid[] = "$OpenBSD: tgoto.c,v 1.2 2003/04/04 18:39:12 millert Exp $";
 #endif
 #endif /* not lint */
 
@@ -175,19 +175,19 @@ setwhich:
 			 * because some terminals use ^I for other things,
 			 * like nondestructive space.
 			 */
-			if (which == 0 || which == CTRL('d') || /* which == '\t' || */ which == '\n') {
-				if (oncol || UP) /* Assumption: backspace works */
-					/*
-					 * Loop needed because newline happens
-					 * to be the successor of tab.
-					 */
-					do {
-						if (strlen(added) + 1 >= sizeof(added))
-							goto toohard;
-						strcat(added, oncol ? (BC ? BC : "\b") : UP);
-						which++;
-					} while (which == '\n');
-			}
+			if ((which == 0 || which == CTRL('d') || which == '\n')
+			    && (oncol || UP)) /* Assumption: backspace works */
+				/*
+				 * Loop needed because newline happens
+				 * to be the successor of tab.
+				 */
+				do {
+					if (strlcat(added, oncol ?
+					    (BC ? BC : "\b") : UP,
+					    sizeof(added)) >= sizeof(added))
+						goto toohard;
+					which++;
+				} while (which == '\n');
 			if (dp >= &result[MAXRETURNSIZE])
 				goto toohard;
 			*dp++ = which;
@@ -225,8 +225,8 @@ setwhich:
 			goto toohard;
 		}
 	}
-	if (dp - result + strlen(added) >= MAXRETURNSIZE - 1)
+	if (strlcpy(dp, added, sizeof(result) - (dp - result))
+	    >= sizeof(result) - (dp - result))
 		goto toohard;
-	strcpy(dp, added);
 	return (result);
 }