ITS#4467

diff --git a/libraries/libldap/search.c b/libraries/libldap/search.c
index d92a8bcd1a0f9d598c27beac8f7b59293834b121..b3a8ddb10e5da38a2545a90f4a03867de869daf4 100644 (file)
--- a/libraries/libldap/search.c
+++ b/libraries/libldap/search.c
@@ -301,27 +301,25 @@ ldap_build_search_req(
 
 #ifdef LDAP_DEBUG
        if ( ldap_debug & LDAP_DEBUG_ARGS ) {
-               char    buf[ BUFSIZ ] = { ' ', '*', '\0' };
+               char    buf[ BUFSIZ ], *ptr = " *";
 
                if ( attrs != NULL ) {
-                       char    *ptr;
-                       int     i;
-
-                       for ( ptr = buf, i = 0;
-                               attrs[ i ] != NULL && ptr < &buf[ sizeof( buf ) ];
-                               i++ )
-                       {
-                               ptr += snprintf( ptr, sizeof( buf ) - ( ptr - buf ),
-                                       " %s", attrs[ i ] );
+                       int     i, len, rest = sizeof( buf );
+
+                       for ( i = 0; attrs[ i ] != NULL && rest > 0; i++ ) {
+                               ptr = &buf[ sizeof( buf ) - rest ];
+                               len = snprintf( ptr, rest, " %s", attrs[ i ] );
+                               rest -= (len >= 0 ? len : (int) sizeof( buf ));
                        }
 
-                       if ( ptr >= &buf[ sizeof( buf ) ] ) {
+                       if ( rest <= 0 ) {
                                AC_MEMCPY( &buf[ sizeof( buf ) - STRLENOF( "...(truncated)" ) - 1 ],
                                        "...(truncated)", STRLENOF( "...(truncated)" ) + 1 );
                        } 
+                       ptr = buf;
                }
 
-               Debug( LDAP_DEBUG_ARGS, "ldap_build_search_req ATTRS:%s\n", buf, 0, 0 );
+               Debug( LDAP_DEBUG_ARGS, "ldap_build_search_req ATTRS:%s\n", ptr, 0,0 );
        }
 #endif /* LDAP_DEBUG */
 

diff --git a/servers/slapd/overlays/pcache.c b/servers/slapd/overlays/pcache.c
index 5ecfc3fb5efc46d2697d115a2109952a5440c6a8..d75ec066728190b063c42ce8bbf35c540b8c24c2 100644 (file)
--- a/servers/slapd/overlays/pcache.c
+++ b/servers/slapd/overlays/pcache.c
@@ -265,17 +265,17 @@ query2url( Operation *op, CachedQuery *q, struct berval *urlbv )
 {
        struct berval   bv_scope,
                        bv_filter;
-       char            attrset_buf[ 32 ],
-                       expiry_buf[ 32 ],
+       char            attrset_buf[ LDAP_PVT_INTTYPE_CHARS( unsigned long ) ],
+                       expiry_buf[ LDAP_PVT_INTTYPE_CHARS( unsigned long ) ],
                        *ptr;
        ber_len_t       attrset_len,
                        expiry_len;
 
        ldap_pvt_scope2bv( q->scope, &bv_scope );
        filter2bv_x( op, q->filter, &bv_filter );
-       attrset_len = snprintf( attrset_buf, sizeof( attrset_buf ),
+       attrset_len = sprintf( attrset_buf,
                "%lu", (unsigned long)q->qtemp->attr_set_index );
-       expiry_len = snprintf( expiry_buf, sizeof( expiry_buf ),
+       expiry_len = sprintf( expiry_buf,
                "%lu", (unsigned long)q->expiry_time );
 
        urlbv->bv_len = STRLENOF( "ldap:///" )
@@ -3797,8 +3797,8 @@ pcache_exop_query_delete(
 
        struct berval   uuid = BER_BVNULL,
                        *uuidp = NULL;
-       char            buf[ SLAP_TEXT_BUFLEN ] = { '\0' };
-       int             len = 0;
+       char            buf[ SLAP_TEXT_BUFLEN ];
+       unsigned        len;
        ber_tag_t       tag = LBER_DEFAULT;
 
        if ( LogTest( LDAP_DEBUG_STATS ) ) {
@@ -3816,7 +3816,7 @@ pcache_exop_query_delete(
                assert( !BER_BVISNULL( &op->o_req_ndn ) );
                len = snprintf( buf, sizeof( buf ), " dn=\"%s\"", op->o_req_ndn.bv_val );
 
-               if ( !BER_BVISNULL( &uuid ) ) {
+               if ( !BER_BVISNULL( &uuid ) && len < sizeof( buf ) ) {
                        snprintf( &buf[ len ], sizeof( buf ) - len, " queryId=\"%s\"", uuid.bv_val );
                }
 

diff --git a/servers/slapd/syncrepl.c b/servers/slapd/syncrepl.c
index 59646f455feb057d91ae0ef6b1762d5094dc0696..b53032a3b7f128a4cb903b4448a03fc0081444c9 100644 (file)
--- a/servers/slapd/syncrepl.c
+++ b/servers/slapd/syncrepl.c
@@ -4078,9 +4078,9 @@ syncrepl_unparse( syncinfo_t *si, struct berval *bv )
 {
        struct berval bc, uri;
        char buf[BUFSIZ*2], *ptr;
+       ber_len_t len;
        int i;
-
-#define WHATSLEFT      ( sizeof( buf ) - ( ptr - buf ) )
+#      define WHATSLEFT        ((ber_len_t) (&buf[sizeof( buf )] - ptr))
 
        BER_BVZERO( bv );
 
@@ -4094,9 +4094,10 @@ syncrepl_unparse( syncinfo_t *si, struct berval *bv )
 
        ptr = buf;
        assert( si->si_rid >= 0 && si->si_rid <= SLAP_SYNC_SID_MAX );
-       ptr += snprintf( ptr, WHATSLEFT, IDSTR "=%03d " PROVIDERSTR "=%s",
+       len = snprintf( ptr, WHATSLEFT, IDSTR "=%03d " PROVIDERSTR "=%s",
                si->si_rid, si->si_bindconf.sb_uri.bv_val );
-       if ( ptr - buf >= sizeof( buf ) ) return;
+       if ( len >= sizeof( buf ) ) return;
+       ptr += len;
        if ( !BER_BVISNULL( &bc ) ) {
                if ( WHATSLEFT <= bc.bv_len ) {
                        free( bc.bv_val );
@@ -4193,36 +4194,42 @@ syncrepl_unparse( syncinfo_t *si, struct berval *bv )
                dd /= 60;
                hh = dd % 24;
                dd /= 24;
-               ptr = lutil_strcopy( ptr, " " INTERVALSTR "=" );
-               ptr += snprintf( ptr, WHATSLEFT, "%02d:%02d:%02d:%02d", dd, hh, mm, ss );
-               if ( ptr - buf >= sizeof( buf ) ) return;
+               len = snprintf( ptr, WHATSLEFT, " %s=%02d:%02d:%02d:%02d",
+                       INTERVALSTR, dd, hh, mm, ss );
+               if ( len >= WHATSLEFT ) return;
+               ptr += len;
        } else if ( si->si_retryinterval ) {
-               int space=0;
+               const char *space = "";
                if ( WHATSLEFT <= STRLENOF( " " RETRYSTR "=\"" "\"" ) ) return;
                ptr = lutil_strcopy( ptr, " " RETRYSTR "=\"" );
                for (i=0; si->si_retryinterval[i]; i++) {
-                       if ( space ) *ptr++ = ' ';
-                       space = 1;
-                       ptr += snprintf( ptr, WHATSLEFT, "%ld ", (long) si->si_retryinterval[i] );
+                       len = snprintf( ptr, WHATSLEFT, "%s%ld ", space,
+                               (long) si->si_retryinterval[i] );
+                       space = " ";
+                       if ( WHATSLEFT - 1 <= len ) return;
+                       ptr += len;
                        if ( si->si_retrynum_init[i] == RETRYNUM_FOREVER )
                                *ptr++ = '+';
-                       else
-                               ptr += snprintf( ptr, WHATSLEFT, "%d", si->si_retrynum_init[i] );
+                       else {
+                               len = snprintf( ptr, WHATSLEFT, "%d", si->si_retrynum_init[i] );
+                               if ( WHATSLEFT <= len ) return;
+                               ptr += len;
+                       }
                }
                if ( WHATSLEFT <= STRLENOF( "\"" ) ) return;
                *ptr++ = '"';
        }
 
        if ( si->si_slimit ) {
-               if ( WHATSLEFT <= STRLENOF( " " SLIMITSTR "=" ) ) return;
-               ptr = lutil_strcopy( ptr, " " SLIMITSTR "=" );
-               ptr += snprintf( ptr, WHATSLEFT, "%d", si->si_slimit );
+               len = snprintf( ptr, WHATSLEFT, " " SLIMITSTR "=%d", si->si_slimit );
+               if ( WHATSLEFT <= len ) return;
+               ptr += len;
        }
 
        if ( si->si_tlimit ) {
-               if ( WHATSLEFT <= STRLENOF( " " TLIMITSTR "=" ) ) return;
-               ptr = lutil_strcopy( ptr, " " TLIMITSTR "=" );
-               ptr += snprintf( ptr, WHATSLEFT, "%d", si->si_tlimit );
+               len = snprintf( ptr, WHATSLEFT, " " TLIMITSTR "=%d", si->si_tlimit );
+               if ( WHATSLEFT <= len ) return;
+               ptr += len;
        }
 
        if ( si->si_syncdata ) {