From: Kern Sibbald <kern@sibbald.com>
Date: Mon, 13 Jan 2003 12:58:45 +0000 (+0000)
Subject: Fix escape_string buffer overflows
X-Git-Tag: Release-1.29~36
X-Git-Url: https://git.sur5r.net/?a=commitdiff_plain;h=73a241b024389bee0103f7b3d70340abfc70df76;p=bacula%2Fbacula

Fix escape_string buffer overflows


git-svn-id: https://bacula.svn.sourceforge.net/svnroot/bacula/trunk@284 91ce42f0-d328-0410-95d8-f526ca767f89
---

diff --git a/bacula/src/cats/mysql.c b/bacula/src/cats/mysql.c
index 8e5736f1bf..6168743468 100644
--- a/bacula/src/cats/mysql.c
+++ b/bacula/src/cats/mysql.c
@@ -216,11 +216,62 @@ int db_next_index(B_DB *mdb, char *table, char *index)
 }   
 
 
-
+/*
+ * Escape strings so that MySQL is happy
+ *
+ *   NOTE! len is the length of the old string. Your new
+ *	   string must be long enough (max 2*old) to hold
+ *	   the escaped output.
+ */
 void
 db_escape_string(char *snew, char *old, int len)
 {
-   mysql_escape_string(snew, old, len);
+   char *n, *o;
+
+   n = snew;
+   o = old;
+   while (len--) {
+      switch (*o) {
+      case 0:
+         *n++= '\\';
+         *n++= '0';
+	 o++;
+	 break;
+      case '\n':
+         *n++= '\\';
+         *n++= 'n';
+	 o++;
+	 break;
+      case '\r':
+         *n++= '\\';
+         *n++= 'r';
+	 o++;
+	 break;
+      case '\\':
+         *n++= '\\';
+         *n++= '\\';
+	 o++;
+	 break;
+      case '\'':
+         *n++= '\\';
+         *n++= '\'';
+	 o++;
+	 break;
+      case '"':
+         *n++= '\\';
+         *n++= '"';
+	 o++;
+	 break;
+      case '\032':
+         *n++= '\\';
+         *n++= 'Z';
+	 o++;
+	 break;
+      default:
+	 *n++= *o++;
+      }
+   }
+   *n = 0;
 }
 
 /*
diff --git a/bacula/src/cats/sql_create.c b/bacula/src/cats/sql_create.c
index 739a376451..63c5e4ed12 100644
--- a/bacula/src/cats/sql_create.c
+++ b/bacula/src/cats/sql_create.c
@@ -518,8 +518,9 @@ static int db_create_path_record(B_DB *mdb, ATTR_DBR *ar)
    SQL_ROW row;
    int stat;
 
-   mdb->esc_name = check_pool_memory_size(mdb->esc_name, mdb->pnl+101);
-   db_escape_string(mdb->esc_name, mdb->path, mdb->pnl+100);
+   mdb->esc_name = check_pool_memory_size(mdb->esc_name, 2*mdb->pnl+2);
+   db_escape_string(mdb->esc_name, mdb->path, mdb->pnl);
+   sm_check(__FILE__, __LINE__, True);
 
    if (mdb->cached_path_id != 0 && mdb->cached_path_len == mdb->pnl &&
        strcmp(mdb->cached_path, mdb->path) == 0) {
@@ -592,9 +593,9 @@ static int db_create_filename_record(B_DB *mdb, ATTR_DBR *ar)
 {
    SQL_ROW row;
 
-   
-   mdb->esc_name = check_pool_memory_size(mdb->esc_name, mdb->fnl+101);
-   db_escape_string(mdb->esc_name, mdb->fname, mdb->fnl+100);
+   mdb->esc_name = check_pool_memory_size(mdb->esc_name, 2*mdb->fnl+2);
+   db_escape_string(mdb->esc_name, mdb->fname, mdb->fnl);
+   sm_check(__FILE__, __LINE__, True);
 
    Mmsg(&mdb->cmd, "SELECT FilenameId FROM Filename WHERE Name='%s'", mdb->esc_name);
 
diff --git a/bacula/src/cats/sql_get.c b/bacula/src/cats/sql_get.c
index 947e980185..da552c315a 100644
--- a/bacula/src/cats/sql_get.c
+++ b/bacula/src/cats/sql_get.c
@@ -50,13 +50,15 @@
 
 /* Forward referenced functions */
 static int db_get_file_record(B_DB *mdb, FILE_DBR *fdbr);
-static int db_get_filename_record(B_DB *mdb, char *fname);
-static int db_get_path_record(B_DB *mdb, char *path);
+static int db_get_filename_record(B_DB *mdb);
+static int db_get_path_record(B_DB *mdb);
 
 
 /* Imported subroutines */
 extern void print_result(B_DB *mdb);
 extern int QueryDB(char *file, int line, B_DB *db, char *select_cmd);
+extern void split_path_and_filename(B_DB *mdb, char *fname);
+
 
 
 /*
@@ -68,79 +70,20 @@ extern int QueryDB(char *file, int line, B_DB *db, char *select_cmd);
  */
 int db_get_file_attributes_record(B_DB *mdb, char *fname, FILE_DBR *fdbr)
 {
-   int fnl, pnl;
-   char *l, *p;
    int stat;
-   char file[MAXSTRING];
-   char spath[MAXSTRING];
-   char buf[MAXSTRING];
    Dmsg1(20, "Enter get_file_from_catalog fname=%s \n", fname);
 
-   /* Find path without the filename.  
-    * I.e. everything after the last / is a "filename".
-    * OK, maybe it is a directory name, but we treat it like
-    * a filename. If we don't find a / then the whole name
-    * must be a path name (e.g. c:).
-    */
-   for (p=l=fname; *p; p++) {
-      if (*p == '/') {
-	 l = p;
-      }
-   }
-   if (*l == '/') {                   /* did we find a slash? */
-      l++;			      /* yes, point to filename */
-   } else {			      /* no, whole thing must be path name */
-      l = p;
-   }
-
-   /* If filename doesn't exist (i.e. root directory), we
-    * simply create a blank name consisting of a single 
-    * space. This makes handling zero length filenames
-    * easier.
-    */
-   fnl = p - l;
-   if (fnl > 255) {
-      Jmsg1(mdb->jcr, M_WARNING, 0, _("Filename truncated to 255 chars: %s\n"), l);
-      fnl = 255;
-   }
-   if (fnl > 0) {
-      strncpy(file, l, fnl);	      /* copy filename */
-      file[fnl] = 0;
-   } else {
-      file[0] = ' ';                  /* blank filename */
-      file[1] = 0;
-      fnl = 1;
-   }
-
-   pnl = l - fname;    
-   if (pnl > 255) {
-      Jmsg1(mdb->jcr, M_WARNING, 0, _("Path name truncated to 255 chars: %s\n"), fname);
-      pnl = 255;
-   }
-   strncpy(spath, fname, pnl);
-   spath[pnl] = 0;
-
-   if (pnl == 0) {
-      Mmsg1(&mdb->errmsg, _("Path length is zero. File=%s\n"), fname);
-      Jmsg(mdb->jcr, M_ERROR, 0, "%s", mdb->errmsg);
-      spath[0] = ' ';
-      spath[1] = 0;
-      pnl = 1;
-   }
-
-   Dmsg1(400, "spath=%s\n", spath);
-   Dmsg1(400, "file=%s\n", file);
+   db_lock(mdb);
+   split_path_and_filename(mdb, fname);
 
-   db_escape_string(buf, file, fnl);
-   fdbr->FilenameId = db_get_filename_record(mdb, buf);
-   Dmsg2(400, "db_get_filename_record FilenameId=%u file=%s\n", fdbr->FilenameId, buf);
+   fdbr->FilenameId = db_get_filename_record(mdb);
 
-   db_escape_string(buf, spath, pnl);
-   fdbr->PathId = db_get_path_record(mdb, buf);
-   Dmsg2(400, "db_get_path_record PathId=%u path=%s\n", fdbr->PathId, buf);
+   fdbr->PathId = db_get_path_record(mdb);
 
    stat = db_get_file_record(mdb, fdbr);
 
+   db_unlock(mdb);
+
    return stat;
 }
 
@@ -162,7 +105,6 @@ int db_get_file_record(B_DB *mdb, FILE_DBR *fdbr)
    SQL_ROW row;
    int stat = 0;
 
-   db_lock(mdb);
    Mmsg(&mdb->cmd, 
 "SELECT FileId, LStat, MD5 from File where File.JobId=%u and File.PathId=%u and \
 File.FilenameId=%u", fdbr->JobId, fdbr->PathId, fdbr->FilenameId);
@@ -196,7 +138,6 @@ File.FilenameId=%u", fdbr->JobId, fdbr->PathId, fdbr->FilenameId);
       }
       sql_free_result(mdb);
    }
-   db_unlock(mdb);
    return stat;
 
 }
@@ -207,18 +148,16 @@ File.FilenameId=%u", fdbr->JobId, fdbr->PathId, fdbr->FilenameId);
  *
  *   DO NOT use Jmsg in this routine (see notes for get_file_record)
  */
-static int db_get_filename_record(B_DB *mdb, char *fname) 
+static int db_get_filename_record(B_DB *mdb)
 {
    SQL_ROW row;
    int FilenameId = 0;
 
-   if (*fname == 0) {
-      Mmsg0(&mdb->errmsg, _("Null name given to db_get_filename_record\n"));
-      Emsg0(M_ABORT, 0, mdb->errmsg);
-   }
-
-   db_lock(mdb);
-   Mmsg(&mdb->cmd, "SELECT FilenameId FROM Filename WHERE Name='%s'", fname);
+   mdb->esc_name = check_pool_memory_size(mdb->esc_name, 2*mdb->fnl+2);
+   db_escape_string(mdb->esc_name, mdb->fname, mdb->fnl);
+   sm_check(__FILE__, __LINE__, True);
+   
+   Mmsg(&mdb->cmd, "SELECT FilenameId FROM Filename WHERE Name='%s'", mdb->esc_name);
    if (QUERY_DB(mdb, mdb->cmd)) {
 
       mdb->num_rows = sql_num_rows(mdb);
@@ -238,11 +177,10 @@ static int db_get_filename_record(B_DB *mdb, char *fname)
 	    }
 	 }
       } else {
-         Mmsg1(&mdb->errmsg, _("Filename record: %s not found.\n"), fname);
+         Mmsg1(&mdb->errmsg, _("Filename record: %s not found.\n"), mdb->fname);
       }
       sql_free_result(mdb);
    }
-   db_unlock(mdb);
    return FilenameId;
 }
 
@@ -252,23 +190,21 @@ static int db_get_filename_record(B_DB *mdb, char *fname)
  *
  *   DO NOT use Jmsg in this routine (see notes for get_file_record)
  */
-static int db_get_path_record(B_DB *mdb, char *path)
+static int db_get_path_record(B_DB *mdb)
 {
    SQL_ROW row;
    uint32_t PathId = 0;
 
-   if (*path == 0) {
-      Emsg0(M_ABORT, 0, _("Null path given to db_get_path_record\n"));
-   }
+   mdb->esc_name = check_pool_memory_size(mdb->esc_name, 2*mdb->pnl+2);
+   db_escape_string(mdb->esc_name, mdb->path, mdb->pnl);
+   sm_check(__FILE__, __LINE__, True);
 
-   db_lock(mdb);
-
-   if (mdb->cached_path_id != 0 && strcmp(mdb->cached_path, path) == 0) {
-      db_unlock(mdb);
+   if (mdb->cached_path_id != 0 && mdb->cached_path_len == mdb->pnl &&
+       strcmp(mdb->cached_path, mdb->path) == 0) {
       return mdb->cached_path_id;
    }	      
 
-   Mmsg(&mdb->cmd, "SELECT PathId FROM Path WHERE Path='%s'", path);
+   Mmsg(&mdb->cmd, "SELECT PathId FROM Path WHERE Path='%s'", mdb->esc_name);
 
    if (QUERY_DB(mdb, mdb->cmd)) {
       char ed1[30];
@@ -291,18 +227,16 @@ static int db_get_path_record(B_DB *mdb, char *path)
 	       /* Cache path */
 	       if (PathId != mdb->cached_path_id) {
 		  mdb->cached_path_id = PathId;
-		  mdb->cached_path = check_pool_memory_size(mdb->cached_path,
-		     strlen(path)+1);
-		  strcpy(mdb->cached_path, path);
+		  mdb->cached_path_len = mdb->pnl;
+		  pm_strcpy(&mdb->cached_path, mdb->path);
 	       }
 	    }
 	 }
       } else {	
-         Mmsg1(&mdb->errmsg, _("Path record: %s not found.\n"), path);
+         Mmsg1(&mdb->errmsg, _("Path record: %s not found.\n"), mdb->path);
       }
       sql_free_result(mdb);
    }
-   db_unlock(mdb);
    return PathId;
 }
 
diff --git a/bacula/src/cats/sql_update.c b/bacula/src/cats/sql_update.c
index 1f2ca28f21..56822936d7 100644
--- a/bacula/src/cats/sql_update.c
+++ b/bacula/src/cats/sql_update.c
@@ -183,15 +183,12 @@ db_update_pool_record(B_DB *mdb, POOL_DBR *pr)
 int
 db_update_media_record(B_DB *mdb, MEDIA_DBR *mr) 
 {
-   char dt[MAX_TIME_LENGTH], dtF[MAX_TIME_LENGTH];
+   char dt[MAX_TIME_LENGTH];
    time_t ttime;
    struct tm tm;
    int stat;
    char ed1[30], ed2[30];
        
-   ttime = mr->LastWritten;
-   localtime_r(&ttime, &tm);
-   strftime(dt, sizeof(dt), "%Y-%m-%d %T", &tm);
 
    Dmsg1(100, "update_media: FirstWritten=%d\n", mr->FirstWritten);
    db_lock(mdb);
@@ -199,22 +196,28 @@ db_update_media_record(B_DB *mdb, MEDIA_DBR *mr)
       Dmsg1(400, "Set FirstWritten Vol=%s\n", mr->VolumeName);
       ttime = mr->FirstWritten;
       localtime_r(&ttime, &tm);
-      strftime(dtF, sizeof(dtF), "%Y-%m-%d %T", &tm);
+      strftime(dt, sizeof(dt), "%Y-%m-%d %T", &tm);
       Mmsg(&mdb->cmd, "UPDATE Media SET FirstWritten='%s'\
- WHERE VolumeName='%s'", dtF, mr->VolumeName);
+ WHERE VolumeName='%s'", dt, mr->VolumeName);
       stat = UPDATE_DB(mdb, mdb->cmd);
       Dmsg1(400, "Firstwritten stat=%d\n", stat);
    }
 
+   ttime = mr->LastWritten;
+   localtime_r(&ttime, &tm);
+   strftime(dt, sizeof(dt), "%Y-%m-%d %T", &tm);
+
    Mmsg(&mdb->cmd, "UPDATE Media SET VolJobs=%u,\
- VolFiles=%u, VolBlocks=%u, VolBytes=%s, VolMounts=%u, VolErrors=%u,\
- VolWrites=%u, MaxVolBytes=%s, LastWritten='%s', VolStatus='%s',\
+ VolFiles=%u,VolBlocks=%u,VolBytes=%s,VolMounts=%u,VolErrors=%u,\
+ VolWrites=%u,MaxVolBytes=%s,LastWritten='%s',VolStatus='%s',\
  Slot=%d WHERE VolumeName='%s'",
    mr->VolJobs, mr->VolFiles, mr->VolBlocks, edit_uint64(mr->VolBytes, ed1),
    mr->VolMounts, mr->VolErrors, mr->VolWrites, 
    edit_uint64(mr->MaxVolBytes, ed2), dt, 
    mr->VolStatus, mr->Slot, mr->VolumeName);
 
+   sm_check(__FILE__, __LINE__, True);
+
    Dmsg1(400, "%s\n", mdb->cmd);
 
    stat = UPDATE_DB(mdb, mdb->cmd);
diff --git a/bacula/src/cats/sqlite.c b/bacula/src/cats/sqlite.c
index 2fe91481ca..007ddfc9aa 100644
--- a/bacula/src/cats/sqlite.c
+++ b/bacula/src/cats/sqlite.c
@@ -222,7 +222,13 @@ int db_next_index(B_DB *mdb, char *table, char *index)
 }   
 
 
-
+/*
+ * Escape strings so that SQLite is happy
+ *
+ *   NOTE! len is the length of the old string. Your new
+ *	   string must be long enough (max 2*old) to hold
+ *	   the escaped output.
+ */
 void
 db_escape_string(char *snew, char *old, int len)
 {
diff --git a/bacula/src/dird/newvol.c b/bacula/src/dird/newvol.c
index 64d83847e4..f7e8ba3e89 100644
--- a/bacula/src/dird/newvol.c
+++ b/bacula/src/dird/newvol.c
@@ -55,6 +55,10 @@ int newVolume(JCR *jcr, MEDIA_DBR *mr)
 	 mr->LabelDate = 0;
 	 strcpy(mr->MediaType, jcr->store->media_type);
 	 strcpy(name, pr.LabelFormat);	 
+         if (strchr(name, (int)'%') != NULL) {
+            Jmsg(jcr, M_ERROR, 0, _("Illegal character in Label Format\n"));
+	    return 0;
+	 }
          strcat(name, "%04d");
 	 sprintf(mr->VolumeName, name, ++pr.NumVols);
 	 if (db_create_media_record(jcr->db, mr) &&
diff --git a/bacula/src/dird/ua_output.c b/bacula/src/dird/ua_output.c
index fb6b3689e6..bf9e8ade06 100644
--- a/bacula/src/dird/ua_output.c
+++ b/bacula/src/dird/ua_output.c
@@ -417,7 +417,7 @@ again:
       bs->msglen = len;
       bnet_send(bs);
    } else {			      /* No UA, send to Job */
-      Jmsg(ua->jcr, M_INFO, 0, msg);
+      Jmsg(ua->jcr, M_INFO, 0, "%s", msg);
       free_pool_memory(msg);
    }
 
diff --git a/bacula/src/filed/restore.c b/bacula/src/filed/restore.c
index a46f91dde4..e6b83112fe 100644
--- a/bacula/src/filed/restore.c
+++ b/bacula/src/filed/restore.c
@@ -431,5 +431,5 @@ static void print_ls_output(JCR *jcr, char *fname, char *lname, int type, struct
    *p++ = '\n';
    *p = 0;
    Dmsg0(20, buf);
-   Jmsg(jcr, M_INFO, 0, buf);
+   Jmsg(jcr, M_INFO, 0, "%s", buf);
 }
diff --git a/bacula/src/filed/verify_vol.c b/bacula/src/filed/verify_vol.c
index 45f2eeb6c4..61a15198a6 100644
--- a/bacula/src/filed/verify_vol.c
+++ b/bacula/src/filed/verify_vol.c
@@ -267,6 +267,6 @@ static void print_ls_output(JCR *jcr, char *fname, char *lname, int type, struct
    *p++ = '\n';
    *p = 0;
    Dmsg0(20, buf);
-   Jmsg(jcr, M_INFO, 0, buf);
+   Jmsg(jcr, M_INFO, 0, "%s", buf);
 }
 #endif
diff --git a/bacula/src/lib/mem_pool.c b/bacula/src/lib/mem_pool.c
index 584dcddf77..1c47b41441 100644
--- a/bacula/src/lib/mem_pool.c
+++ b/bacula/src/lib/mem_pool.c
@@ -21,7 +21,7 @@
  */
 
 /*
-   Copyright (C) 2000, 2001, 2002 Kern Sibbald and John Walker
+   Copyright (C) 2000-2003 Kern Sibbald and John Walker
 
    This program is free software; you can redistribute it and/or
    modify it under the terms of the GNU General Public License as
@@ -50,12 +50,27 @@ struct s_pool_ctl {
    struct abufhead *free_buf;	      /* pointer to free buffers */
 };
 
+#ifndef STRESS_TEST_POOL
+/*
+ * Define default Pool buffer sizes
+ */
 static struct s_pool_ctl pool_ctl[] = {
    {  256,  256, 0, 0, NULL },	      /* PM_NOPOOL no pooling */
    {  256,  256, 0, 0, NULL },	      /* PM_FNAME filename buffers */
    {  512,  512, 0, 0, NULL },	      /* PM_MESSAGE message buffer */
    { 1024, 1024, 0, 0, NULL }	      /* PM_EMSG error message buffer */
 };
+#else
+
+/* This is used ONLY when stress testing the code */
+static struct s_pool_ctl pool_ctl[] = {
+   {   10,   10, 0, 0, NULL },	      /* PM_NOPOOL no pooling */
+   {   10,   10, 0, 0, NULL },	      /* PM_FNAME filename buffers */
+   {   10,   10, 0, 0, NULL },	      /* PM_MESSAGE message buffer */
+   {   10,   10, 0, 0, NULL }	      /* PM_EMSG error message buffer */
+};
+#endif
+
 
 /*  Memory allocation control structures and storage.  */
 struct abufhead {
@@ -152,7 +167,8 @@ POOLMEM *sm_realloc_pool_memory(char *fname, int lineno, POOLMEM *obuf, size_t s
    ASSERT(obuf);
    P(mutex);
    cp -= HEAD_SIZE;
-   buf = realloc(cp, size+HEAD_SIZE);
+   buf = sm_realloc(fname, lineno, cp, size+HEAD_SIZE);
+   sm_check(fname, lineno, True);
    if (buf == NULL) {
       V(mutex);
       Emsg1(M_ABORT, 0, "Out of memory requesting %d bytes\n", size);
@@ -177,8 +193,40 @@ POOLMEM *sm_check_pool_memory_size(char *fname, int lineno, POOLMEM *obuf, size_
    return realloc_pool_memory(obuf, size);
 }
 
+/* Free a memory buffer */
+void sm_free_pool_memory(char *fname, int lineno, POOLMEM *obuf)
+{
+   struct abufhead *buf;
+   int pool;
+
+   sm_check(fname, lineno, True);
+   ASSERT(obuf);
+   P(mutex);
+   buf = (struct abufhead *)((char *)obuf - HEAD_SIZE);
+   pool = buf->pool;
+   pool_ctl[pool].in_use--;
+   if (pool == 0) {
+      free((char *)buf);	      /* free nonpooled memory */
+   } else {			      /* otherwise link it to the free pool chain */
+#ifdef DEBUG
+      struct abufhead *next;
+      /* Don't let him free the same buffer twice */
+      for (next=pool_ctl[pool].free_buf; next; next=next->next) {
+	 ASSERT(next != buf);  /* attempt to free twice */
+      }
+#endif
+      buf->next = pool_ctl[pool].free_buf;
+      pool_ctl[pool].free_buf = buf;
+   }
+   Dmsg2(150, "free_pool_memory %x pool=%d\n", buf, pool);
+   V(mutex);
+}
+
+
 #else
 
+/* ===================================================================	*/
+
 POOLMEM *get_pool_memory(int pool)
 {
    struct abufhead *buf;
@@ -269,10 +317,6 @@ POOLMEM *check_pool_memory_size(POOLMEM *obuf, size_t size)
    return realloc_pool_memory(obuf, size);
 }
 
-#endif /* SMARTALLOC */
-
-
-
 /* Free a memory buffer */
 void free_pool_memory(POOLMEM *obuf)
 {
@@ -302,6 +346,11 @@ void free_pool_memory(POOLMEM *obuf)
    V(mutex);
 }
 
+#endif /* SMARTALLOC */
+
+
+
+
 
 
 /* Release all pooled memory */
diff --git a/bacula/src/lib/mem_pool.h b/bacula/src/lib/mem_pool.h
index c1bc88a2d8..ef39a3dc1d 100644
--- a/bacula/src/lib/mem_pool.h
+++ b/bacula/src/lib/mem_pool.h
@@ -42,6 +42,11 @@ extern POOLMEM  *sm_realloc_pool_memory(char *fname, int line, POOLMEM *buf, siz
 #define check_pool_memory_size(buf,size) sm_check_pool_memory_size(__FILE__, __LINE__, buf, size)
 extern POOLMEM  *sm_check_pool_memory_size(char *fname, int line, POOLMEM *buf, size_t size);
 
+#define free_pool_memory(x) sm_free_pool_memory(__FILE__, __LINE__, x) 
+#define free_memory(x) sm_free_pool_memory(__FILE__, __LINE__, x) 
+extern void sm_free_pool_memory(char *fname, int line, POOLMEM *buf);
+
+
 #else
 
 extern POOLMEM *get_pool_memory(int pool);
@@ -49,11 +54,11 @@ extern POOLMEM *get_memory(size_t size);
 extern size_t sizeof_pool_memory(POOLMEM *buf);
 extern POOLMEM  *realloc_pool_memory(POOLMEM *buf, size_t size);
 extern POOLMEM  *check_pool_memory_size(POOLMEM *buf, size_t size);
+#define free_memory(x) free_pool_memory(x)
+extern void   free_pool_memory(POOLMEM *buf);
 
 #endif
  
-#define free_memory(x) free_pool_memory(x)
-extern void   free_pool_memory(POOLMEM *buf);
 extern void  close_memory_pool();
 extern void  print_memory_pool_stats();
 
diff --git a/bacula/src/lib/message.c b/bacula/src/lib/message.c
index 3bcf27f15a..b6e75fd04b 100755
--- a/bacula/src/lib/message.c
+++ b/bacula/src/lib/message.c
@@ -529,7 +529,7 @@ void dispatch_message(void *vjcr, int type, int level, char *msg)
     Dmsg2(200, "Enter dispatch_msg type=%d msg=%s\n", type, msg);
 
     if (type == M_ABORT || type == M_ERROR_TERM) {
-       fprintf(stdout, msg);	      /* print this here to INSURE that it is printed */
+       fprintf(stdout, "%s", msg);        /* print this here to INSURE that it is printed */
     }
 
     /* Now figure out where to send the message */
@@ -648,11 +648,11 @@ void dispatch_message(void *vjcr, int type, int level, char *msg)
 	     case MD_STDOUT:
                 Dmsg1(400, "STDOUT for following msg: %s", msg);
 		if (type != M_ABORT && type != M_ERROR_TERM)  /* already printed */
-		   fprintf(stdout, msg);
+                   fprintf(stdout, "%s", msg);
 		break;
 	     case MD_STDERR:
                 Dmsg1(400, "STDERR for following msg: %s", msg);
-		fprintf(stderr, msg);
+                fprintf(stderr, "%s", msg);
 		break;
 	     default:
 		break;
@@ -700,7 +700,7 @@ d_msg(char *file, int line, int level, char *fmt,...)
        bvsnprintf(buf+i, sizeof(buf)-i, (char *)fmt, arg_ptr);
        va_end(arg_ptr);
 
-       fprintf(stdout, buf);
+       fprintf(stdout, "%s", buf);
     }
 }
 
diff --git a/bacula/src/lib/smartall.c b/bacula/src/lib/smartall.c
index a3931d4160..a5b4beed73 100644
--- a/bacula/src/lib/smartall.c
+++ b/bacula/src/lib/smartall.c
@@ -395,6 +395,7 @@ int sm_check_rtn(char *fname, int lineno, Boolean bufdump)
 	   if (bad) {
 	      Emsg2(M_FATAL, 0, 
                  "\nDamaged buffers found at %s:%d\n", fname, lineno);
+
 	      if (bad & 0x1) {
                  Emsg0(M_FATAL, 0, "  discovery of bad prev link.\n");
 	      }
diff --git a/bacula/src/stored/append.c b/bacula/src/stored/append.c
index 635477d5b8..aa2220ffee 100644
--- a/bacula/src/stored/append.c
+++ b/bacula/src/stored/append.c
@@ -244,13 +244,13 @@ int do_append_data(JCR *jcr)
    }
    /* Write out final block of this session */
    if (!write_block_to_device(jcr, dev, block)) {
-      Pmsg0(000, "Set ok=FALSE after write_block_to_device.\n");
+      Pmsg0(000, _("Set ok=FALSE after write_block_to_device.\n"));
       ok = FALSE;
    }
 
    /* Release the device */
    if (!release_device(jcr, dev)) {
-      Pmsg0(000, "Error in release_device\n");
+      Pmsg0(000, _("Error in release_device\n"));
       ok = FALSE;
    }
 
diff --git a/bacula/src/stored/bls.c b/bacula/src/stored/bls.c
index 231fae8315..8052c20e96 100644
--- a/bacula/src/stored/bls.c
+++ b/bacula/src/stored/bls.c
@@ -110,7 +110,7 @@ int main (int argc, char *argv[])
 
          case 'e':                    /* exclude list */
             if ((fd = fopen(optarg, "r")) == NULL) {
-               Pmsg2(0, "Could not open exclude file: %s, ERR=%s\n",
+               Pmsg2(0, _("Could not open exclude file: %s, ERR=%s\n"),
 		  optarg, strerror(errno));
 	       exit(1);
 	    }
diff --git a/bacula/src/stored/bscan.c b/bacula/src/stored/bscan.c
index 8f3fe3185a..711b1ae4c5 100644
--- a/bacula/src/stored/bscan.c
+++ b/bacula/src/stored/bscan.c
@@ -292,7 +292,7 @@ static void record_cb(JCR *bjcr, DEVICE *dev, DEV_BLOCK *block, DEV_RECORD *rec)
       }
       switch (rec->FileIndex) {
 	 case PRE_LABEL:
-            Pmsg0(000, "Volume is prelabeled. This tape cannot be scanned.\n");
+            Pmsg0(000, _("Volume is prelabeled. This tape cannot be scanned.\n"));
 	    return;
 	    break;
 	 case VOL_LABEL:
@@ -302,21 +302,21 @@ static void record_cb(JCR *bjcr, DEVICE *dev, DEV_BLOCK *block, DEV_RECORD *rec)
 	    strcpy(pr.PoolType, dev->VolHdr.PoolType);
 	    if (db_get_pool_record(db, &pr)) {
 	       if (verbose) {
-                  Pmsg1(000, "Pool record for %s found in DB.\n", pr.Name);
+                  Pmsg1(000, _("Pool record for %s found in DB.\n"), pr.Name);
 	       }
 	    } else {
 	       if (!update_db) {
-                  Pmsg1(000, "VOL_LABEL: Pool record not found for Pool: %s\n",
+                  Pmsg1(000, _("VOL_LABEL: Pool record not found for Pool: %s\n"),
 		     pr.Name);
 	       }
 	       create_pool_record(db, &pr);
 	    }
 	    if (strcmp(pr.PoolType, dev->VolHdr.PoolType) != 0) {
-               Pmsg2(000, "VOL_LABEL: PoolType mismatch. DB=%s Vol=%s\n",
+               Pmsg2(000, _("VOL_LABEL: PoolType mismatch. DB=%s Vol=%s\n"),
 		  pr.PoolType, dev->VolHdr.PoolType);
 	       return;
 	    } else if (verbose) {
-               Pmsg1(000, "Pool type \"%s\" is OK.\n", pr.PoolType);
+               Pmsg1(000, _("Pool type \"%s\" is OK.\n"), pr.PoolType);
 	    }
 
 	    /* Check Media Info */
@@ -325,25 +325,25 @@ static void record_cb(JCR *bjcr, DEVICE *dev, DEV_BLOCK *block, DEV_RECORD *rec)
 	    mr.PoolId = pr.PoolId;
 	    if (db_get_media_record(db, &mr)) {
 	       if (verbose) {
-                  Pmsg1(000, "Media record for %s found in DB.\n", mr.VolumeName);
+                  Pmsg1(000, _("Media record for %s found in DB.\n"), mr.VolumeName);
 	       }
 	       /* Clear out some volume statistics that will be updated */
 	       mr.VolJobs = mr.VolFiles = mr.VolBlocks = 0;
 	       mr.VolBytes = rec->data_len + 20;
 	    } else {
 	       if (!update_db) {
-                  Pmsg1(000, "VOL_LABEL: Media record not found for Volume: %s\n",
+                  Pmsg1(000, _("VOL_LABEL: Media record not found for Volume: %s\n"),
 		     mr.VolumeName);
 	       }
 	       strcpy(mr.MediaType, dev->VolHdr.MediaType);
 	       create_media_record(db, &mr, &dev->VolHdr);
 	    }
 	    if (strcmp(mr.MediaType, dev->VolHdr.MediaType) != 0) {
-               Pmsg2(000, "VOL_LABEL: MediaType mismatch. DB=%s Vol=%s\n",
+               Pmsg2(000, _("VOL_LABEL: MediaType mismatch. DB=%s Vol=%s\n"),
 		  mr.MediaType, dev->VolHdr.MediaType);
 	       return;
 	    } else if (verbose) {
-               Pmsg1(000, "Media type \"%s\" is OK.\n", mr.MediaType);
+               Pmsg1(000, _("Media type \"%s\" is OK.\n"), mr.MediaType);
 	    }
 	    /* Reset some JCR variables */
 	    for (mjcr=NULL; (mjcr=next_attached_jcr(dev, mjcr)); ) {
@@ -352,7 +352,7 @@ static void record_cb(JCR *bjcr, DEVICE *dev, DEV_BLOCK *block, DEV_RECORD *rec)
 	       mjcr->StartFile = mjcr->EndFile = 0;
 	    }
 
-            Pmsg1(000, "VOL_LABEL: OK for Volume: %s\n", mr.VolumeName);
+            Pmsg1(000, _("VOL_LABEL: OK for Volume: %s\n"), mr.VolumeName);
 	    break;
 	 case SOS_LABEL:
 	    mr.VolJobs++;
@@ -373,7 +373,7 @@ static void record_cb(JCR *bjcr, DEVICE *dev, DEV_BLOCK *block, DEV_RECORD *rec)
 	    } else {
 	       /* Must create a Job record in DB */
 	       if (!update_db) {
-                  Pmsg1(000, "SOS_LABEL: Job record not found for JobId: %d\n",
+                  Pmsg1(000, _("SOS_LABEL: Job record not found for JobId: %d\n"),
 		     jr.JobId);
 	       }
 	    }
@@ -408,19 +408,19 @@ static void record_cb(JCR *bjcr, DEVICE *dev, DEV_BLOCK *block, DEV_RECORD *rec)
 	    pm_strcpy(&mjcr->pool_name, label.PoolName);
 
 	    if (rec->VolSessionId != jr.VolSessionId) {
-               Pmsg3(000, "SOS_LABEL: VolSessId mismatch for JobId=%u. DB=%d Vol=%d\n",
+               Pmsg3(000, _("SOS_LABEL: VolSessId mismatch for JobId=%u. DB=%d Vol=%d\n"),
 		  jr.JobId,
 		  jr.VolSessionId, rec->VolSessionId);
 	       return;
 	    }
 	    if (rec->VolSessionTime != jr.VolSessionTime) {
-               Pmsg3(000, "SOS_LABEL: VolSessTime mismatch for JobId=%u. DB=%d Vol=%d\n",
+               Pmsg3(000, _("SOS_LABEL: VolSessTime mismatch for JobId=%u. DB=%d Vol=%d\n"),
 		  jr.JobId,
 		  jr.VolSessionTime, rec->VolSessionTime);
 	       return;
 	    }
 	    if (jr.PoolId != pr.PoolId) {
-               Pmsg3(000, "SOS_LABEL: PoolId mismatch for JobId=%u. DB=%d Vol=%d\n",
+               Pmsg3(000, _("SOS_LABEL: PoolId mismatch for JobId=%u. DB=%d Vol=%d\n"),
 		  jr.JobId,
 		  jr.PoolId, pr.PoolId);
 	       return;
@@ -1118,7 +1118,7 @@ int dir_ask_sysop_to_mount_volume(JCR *jcr, DEVICE *dev)
    Dmsg1(100, "Walk attached jcrs. Volume=%s\n", dev->VolCatInfo.VolCatName);
    for (JCR *mjcr=NULL; (mjcr=next_attached_jcr(dev, mjcr)); ) {
       if (verbose) {
-         Pmsg1(000, "create JobMedia for Job %s\n", mjcr->Job);
+         Pmsg1(000, _("Create JobMedia for Job %s\n"), mjcr->Job);
       }
       if (dev->state & ST_TAPE) {
 	 mjcr->EndBlock = dev->EndBlock;
@@ -1133,7 +1133,7 @@ int dir_ask_sysop_to_mount_volume(JCR *jcr, DEVICE *dev)
       }
    }
 
-   fprintf(stderr, "Mount Volume %s on device %s and press return when ready: ",
+   fprintf(stderr, _("Mount Volume %s on device %s and press return when ready: "),
       jcr->VolumeName, dev_name(dev));
    getchar();	
    return 1;
diff --git a/bacula/src/stored/dev.c b/bacula/src/stored/dev.c
index 7049b43262..db53477c13 100644
--- a/bacula/src/stored/dev.c
+++ b/bacula/src/stored/dev.c
@@ -259,11 +259,11 @@ open_dev(DEVICE *dev, char *VolName, int mode)
        * Handle opening of file
        */
       archive_name = get_pool_memory(PM_FNAME);
-      strcpy(archive_name, dev->dev_name);
+      pm_strcpy(&archive_name, dev->dev_name);
       if (archive_name[strlen(archive_name)] != '/') {
-         strcat(archive_name, "/");
+         pm_strcat(&archive_name, "/");
       }
-      strcat(archive_name, VolName);
+      pm_strcat(&archive_name, VolName);
       Dmsg1(29, "open_dev: device is disk %s\n", archive_name);
       if (mode == READ_WRITE) {
 	 dev->mode = O_CREAT | O_RDWR | O_BINARY;
diff --git a/bacula/src/stored/label.c b/bacula/src/stored/label.c
index 92a23dff25..ddaf67d307 100644
--- a/bacula/src/stored/label.c
+++ b/bacula/src/stored/label.c
@@ -190,8 +190,9 @@ int unser_volume_label(DEVICE *dev, DEV_RECORD *rec)
    dev->VolHdr.LabelSize = rec->data_len;
 
 
-  /* Unserialize the record into the Volume Header */
-  ser_begin(rec->data, SER_LENGTH_Volume_Label);
+   /* Unserialize the record into the Volume Header */
+   rec->data = check_pool_memory_size(rec->data, SER_LENGTH_Volume_Label);
+   ser_begin(rec->data, SER_LENGTH_Volume_Label);
 #define Fld(x)	(dev->VolHdr.x)
    unser_string(Fld(Id));
 
@@ -269,6 +270,7 @@ static void create_volume_label_record(JCR *jcr, DEVICE *dev, DEV_RECORD *rec)
 
    /* Serialize the label into the device record. */
 
+   rec->data = check_pool_memory_size(rec->data, SER_LENGTH_Volume_Label);
    ser_begin(rec->data, SER_LENGTH_Volume_Label);
 #define Fld(x)	(dev->VolHdr.x)
    ser_string(Fld(Id));
@@ -449,6 +451,7 @@ void create_session_label(JCR *jcr, DEV_RECORD *rec, int label)
    rec->VolSessionTime = jcr->VolSessionTime;
    rec->Stream	       = jcr->JobId;
 
+   rec->data = check_pool_memory_size(rec->data, SER_LENGTH_Session_Label);
    ser_begin(rec->data, SER_LENGTH_Session_Label);
    ser_string(BaculaId);
    ser_uint32(BaculaTapeVersion);
@@ -643,6 +646,7 @@ int unser_session_label(SESSION_LABEL *label, DEV_RECORD *rec)
 {
    ser_declare;
 
+   rec->data = check_pool_memory_size(rec->data, SER_LENGTH_Session_Label);
    unser_begin(rec->data, SER_LENGTH_Session_Label);
    unser_string(label->Id);
    unser_uint32(label->VerNum);