external/cde
1
0
Fork 0
mirror of git://git.code.sf.net/p/cdesktopenv/code synced 2025-03-09 15:50:02 +00:00
Code Issues Releases Wiki Activity

dtcalc: Resolve "format not a string literal and no format arguments [-Wformat-security]" warnings.

Browse source 
Fix warnings related to secruity concerns on varargs functions. By specifying
"%s" on single string calls to sprintf() (and related) it's not possible to
have a % in the input string causing random data to be read off the stack.
This commit is contained in:
Peter Howkins 2012-08-22 11:28:36 +01:00
parent 7d50721685
commit 20c107bce2
2 changed files with 9 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

8
cde/programs/dtcalc/calctool.c
View file

@ -563,7 +563,7 @@ char *argv[] ;
{ {
msg = (char *) XtMalloc(strlen( msg = (char *) XtMalloc(strlen(
opts[(int) O_ACCRANGE]) + 3); opts[(int) O_ACCRANGE]) + 3);
sprintf(msg, opts[(int) O_ACCRANGE]); sprintf(msg, "%s", opts[(int) O_ACCRANGE]);
_DtSimpleError (v->appname, DtWarning, NULL, msg); _DtSimpleError (v->appname, DtWarning, NULL, msg);
XtFree(msg); XtFree(msg);
v->accuracy = 2 ; v->accuracy = 2 ;
@ -619,7 +619,7 @@ char *argv[] ;
{ {
msg = (char *) XtMalloc(strlen( msg = (char *) XtMalloc(strlen(
opts[(int) O_BASE]) + 3); opts[(int) O_BASE]) + 3);
sprintf(msg, opts[(int) O_BASE]); sprintf(msg, "%s", opts[(int) O_BASE]);
_DtSimpleError (v->appname, DtWarning, NULL, msg); _DtSimpleError (v->appname, DtWarning, NULL, msg);
XtFree(msg); XtFree(msg);
v->base = DEC ; v->base = DEC ;
@ -1688,8 +1688,8 @@ usage(progname)
char *progname ; char *progname ;
{ {
FPRINTF(stderr, ustrs[(int) USAGE1], PATCHLEVEL) ; FPRINTF(stderr, ustrs[(int) USAGE1], PATCHLEVEL) ;
FPRINTF(stderr, ustrs[(int) USAGE2]) ; FPRINTF(stderr, "%s", ustrs[(int) USAGE2]) ;
FPRINTF(stderr, ustrs[(int) USAGE3]) ; FPRINTF(stderr, "%s", ustrs[(int) USAGE3]) ;
exit(1) ; exit(1) ;
} }

10
cde/programs/dtcalc/motif.c
View file

@ -312,7 +312,7 @@ char **argv ;
tmpStr = GETMESSAGE(2, 31, "Could not open display.\n"); tmpStr = GETMESSAGE(2, 31, "Could not open display.\n");
msg = XtNewString(tmpStr); msg = XtNewString(tmpStr);
FPRINTF(stderr, msg) ; FPRINTF(stderr, "%s", msg) ;
exit(1) ; exit(1) ;
} }
@ -3294,7 +3294,7 @@ XtPointer client_data, call_data ;
if ((strcmp(X->cfval, "") == 0) || X->cfval[0] < '0' || X->cfval[0] > '9' || if ((strcmp(X->cfval, "") == 0) || X->cfval[0] < '0' || X->cfval[0] > '9' ||
X->cfno < 0 || X->cfno > 9) X->cfno < 0 || X->cfno > 9)
{ {
SPRINTF(str, (X->CFtype == M_CON) ? vstrs[(int) V_LCON] SPRINTF(str, "%s", (X->CFtype == M_CON) ? vstrs[(int) V_LCON]
: vstrs[(int) V_LFUN]) ; : vstrs[(int) V_LFUN]) ;
SPRINTF(message, "%s\n%s", str, vstrs[(int) V_RANGE]) ; SPRINTF(message, "%s\n%s", str, vstrs[(int) V_RANGE]) ;
do_continue_notice(X->CFframe, message) ; do_continue_notice(X->CFframe, message) ;
@ -3701,7 +3701,7 @@ read_resources() /* Read all possible resources from the database. */
else else
{ {
msg = (char *) XtMalloc(strlen( opts[(int) O_BASE]) + 3); msg = (char *) XtMalloc(strlen( opts[(int) O_BASE]) + 3);
sprintf(msg, opts[(int) O_BASE]); sprintf(msg, "%s", opts[(int) O_BASE]);
_DtSimpleError (v->appname, DtWarning, NULL, msg); _DtSimpleError (v->appname, DtWarning, NULL, msg);
XtFree(msg); XtFree(msg);
v->base = (enum base_type) 2; v->base = (enum base_type) 2;
@ -4422,7 +4422,7 @@ RestoreSession()
if (v->accuracy < 0 || v->accuracy > 9) if (v->accuracy < 0 || v->accuracy > 9)
{ {
msg = (char *) XtMalloc(strlen( opts[(int) O_ACCRANGE]) + 3); msg = (char *) XtMalloc(strlen( opts[(int) O_ACCRANGE]) + 3);
sprintf(msg, opts[(int) O_ACCRANGE]); sprintf(msg, "%s", opts[(int) O_ACCRANGE]);
_DtSimpleError (v->appname, DtWarning, NULL, msg); _DtSimpleError (v->appname, DtWarning, NULL, msg);
XtFree(msg); XtFree(msg);
v->accuracy = 2 ; v->accuracy = 2 ;
@ -4437,7 +4437,7 @@ RestoreSession()
if (i == MAXBASES) if (i == MAXBASES)
{ {
msg = (char *) XtMalloc(strlen( opts[(int) O_BASE]) + 3); msg = (char *) XtMalloc(strlen( opts[(int) O_BASE]) + 3);
sprintf(msg, opts[(int) O_BASE]); sprintf(msg, "%s", opts[(int) O_BASE]);
_DtSimpleError (v->appname, DtWarning, NULL, msg); _DtSimpleError (v->appname, DtWarning, NULL, msg);
XtFree(msg); XtFree(msg);
} }