From dd3a975743fb0d6f5b315a3264e8753699566e76 Mon Sep 17 00:00:00 2001 From: dmiller Date: Fri, 17 Jul 2026 21:56:29 +0000 Subject: [PATCH] Replace instances of sprintf with Snprintf --- libnetutil/packettrace.cc | 7 ++----- nmap_error.cc | 2 +- nping/utils_net.cc | 28 ++++++++++++++++++-------- nse_fs.cc | 2 +- nsock/src/netutils.c | 4 ++-- output.cc | 42 +++++++++++++++++++-------------------- 6 files changed, 47 insertions(+), 38 deletions(-) diff --git a/libnetutil/packettrace.cc b/libnetutil/packettrace.cc index ce4d09c83..1f9dee6ad 100644 --- a/libnetutil/packettrace.cc +++ b/libnetutil/packettrace.cc @@ -1148,11 +1148,8 @@ icmpbad: srchost, dsthost); } } else { - char icmpinfo[512] = ""; /* Temp info about ICMP. */ - sprintf(icmpinfo,"type=%d/code=%d", icmp.icmp_type, icmp.icmp_code); - - return Snprintf(outbuf, outlen, "ICMP [%s > %s %s (%s) %s]", - srchost, dsthost, icmptype, icmpinfo, icmpfields); + return Snprintf(outbuf, outlen, "ICMP [%s > %s %s (type=%d/code=%d) %s]", + srchost, dsthost, icmptype, icmp.icmp_type, icmp.icmp_code, icmpfields); } } diff --git a/nmap_error.cc b/nmap_error.cc index 057f51717..3dda4d08d 100644 --- a/nmap_error.cc +++ b/nmap_error.cc @@ -87,7 +87,7 @@ extern NmapOps o; #ifndef HAVE_STRERROR char *strerror(int errnum) { static char buf[1024]; - sprintf(buf, "your system is too old for strerror of errno %d\n", errnum); + Snprintf(buf, sizeof(buf), "your system is too old for strerror of errno %d\n", errnum); return buf; } #endif diff --git a/nping/utils_net.cc b/nping/utils_net.cc index 9fc879cef..ed2e747b1 100644 --- a/nping/utils_net.cc +++ b/nping/utils_net.cc @@ -824,23 +824,35 @@ const char *arppackethdrinfo(const u8 *packet, u32 len, int detail){ u8 *tMAC = (u8 *)(packet+18); u32 *tIP = (u32 *)(packet+24); + int rem = sizeof(protoinfo); + int n = 0; if( ntohs(*op) == 1 ){ /* ARP Request */ - sprintf(protoinfo, "ARP who has %s? ", IPtoa(*tIP)); - sprintf(protoinfo+strlen(protoinfo),"Tell %s", IPtoa(*sIP) ); + n = Snprintf(protoinfo, rem, "ARP who has %s? ", IPtoa(*tIP)); + if (n < rem) { + rem -= n; + Snprintf(protoinfo + n, rem, "Tell %s", IPtoa(*sIP)); + } } else if( ntohs(*op) == 2 ){ /* ARP Reply */ - sprintf(protoinfo, "ARP reply %s ", IPtoa(*sIP)); - sprintf(protoinfo+strlen(protoinfo),"is at %s", MACtoa(sMAC) ); + Snprintf(protoinfo, sizeof(protoinfo), "ARP reply %s is at %s", IPtoa(*sIP), MACtoa(sMAC)); } else if( ntohs(*op) == 3 ){ /* RARP Request */ - sprintf(protoinfo, "RARP who is %s? Tell %s", MACtoa(tMAC), MACtoa(sMAC) ); + n = Snprintf(protoinfo, rem, "RARP who is %s? ", MACtoa(tMAC)); + if (n < rem) { + rem -= n; + Snprintf(protoinfo + n, rem, "Tell %s", MACtoa(sMAC)); + } } else if( ntohs(*op) ==4 ){ /* RARP Reply */ - sprintf(protoinfo, "RARP reply: %s is at %s", MACtoa(tMAC), IPtoa(*tIP) ); + Snprintf(protoinfo, sizeof(protoinfo), "RARP reply: %s is at %s", MACtoa(tMAC), IPtoa(*tIP) ); } else{ - sprintf(protoinfo, "HTYPE:%04X PTYPE:%04X HLEN:%d PLEN:%d OP:%04X SMAC:%s SIP:%s DMAC:%s DIP:%s", - *htype, *ptype, *hlen, *plen, *op, MACtoa(sMAC), IPtoa(*sIP), MACtoa(tMAC), IPtoa(*tIP)); + n = Snprintf(protoinfo, rem, "HTYPE:%04X PTYPE:%04X HLEN:%d PLEN:%d OP:%04X SMAC:%s SIP:%s ", + *htype, *ptype, *hlen, *plen, *op, MACtoa(sMAC), IPtoa(*sIP)); + if (n < rem) { + rem -= n; + Snprintf(protoinfo + n, rem, "DMAC:%s DIP:%s", MACtoa(tMAC), IPtoa(*tIP)); + } } return protoinfo; } /* End of arppackethdrinfo() */ diff --git a/nse_fs.cc b/nse_fs.cc index f43a3f63f..5850cd00d 100644 --- a/nse_fs.cc +++ b/nse_fs.cc @@ -229,7 +229,7 @@ static int dir_iter_factory (lua_State *L) { if (strlen(path) > MAX_PATH-2) luaL_error (L, "path too long: %s", path); else - sprintf (d->pattern, "%s/*", path); + Snprintf (d->pattern, sizeof(d->pattern), "%s/*", path); #else d->dir = opendir (path); if (d->dir == NULL) diff --git a/nsock/src/netutils.c b/nsock/src/netutils.c index c6f05ac64..4d6177be4 100644 --- a/nsock/src/netutils.c +++ b/nsock/src/netutils.c @@ -157,12 +157,12 @@ static char *get_addr_string(const struct sockaddr_storage *ss, size_t sslen) { #if HAVE_SYS_UN_H if (ss->ss_family == AF_UNIX) { - sprintf(buffer, "%s", get_unixsock_path(ss)); + Strncpy(buffer, get_unixsock_path(ss), sizeof(buffer)); return buffer; } #endif - sprintf(buffer, "%s:%d", inet_ntop_ez(ss, sslen), get_port(ss)); + Snprintf(buffer, sizeof(buffer), "%s:%d", inet_ntop_ez(ss, sslen), get_port(ss)); return buffer; } diff --git a/output.cc b/output.cc index 52a595b5b..f6e1459a4 100644 --- a/output.cc +++ b/output.cc @@ -1995,14 +1995,14 @@ void printosscanoutput(const Target *currenths) { if (currenths->seq.responses > 3) { p = numlst; + size_t remaining = sizeof(numlst); for (i = 0; i < currenths->seq.responses; i++) { - if (p - numlst > (int) (sizeof(numlst) - 15)) - fatal("STRANGE ERROR #3877 -- please report to fyodor@nmap.org\n"); - if (p != numlst) - *p++ = ','; - sprintf(p, "%X", currenths->seq.seqs[i]); - while (*p) - p++; + int n = Snprintf(p, remaining, "%s%X", + (p != numlst) ? "," : "", currenths->seq.seqs[i]); + if (n >= remaining) + fatal("numlst overflow"); + p += n; + remaining -= n; } xml_open_start_tag("tcpsequence"); @@ -2019,14 +2019,14 @@ void printosscanoutput(const Target *currenths) { if (currenths->seq.responses > 2) { p = numlst; + size_t remaining = sizeof(numlst); for (i = 0; i < currenths->seq.responses; i++) { - if (p - numlst > (int) (sizeof(numlst) - 15)) - fatal("STRANGE ERROR #3876 -- please report to fyodor@nmap.org\n"); - if (p != numlst) - *p++ = ','; - sprintf(p, "%hX", currenths->seq.ipids[i]); - while (*p) - p++; + int n = Snprintf(p, remaining, "%s%hX", + (p != numlst) ? "," : "", currenths->seq.ipids[i]); + if (n >= remaining) + fatal("numlst overflow"); + p += n; + remaining -= n; } xml_open_start_tag("ipidsequence"); xml_attribute("class", "%s", ipidclass2ascii(currenths->seq.ipid_seqclass)); @@ -2040,14 +2040,14 @@ void printosscanoutput(const Target *currenths) { ipidclass2ascii(currenths->seq.ipid_seqclass)); p = numlst; + remaining = sizeof(numlst); for (i = 0; i < currenths->seq.responses; i++) { - if (p - numlst > (int) (sizeof(numlst) - 15)) - fatal("STRANGE ERROR #3878 -- please report to fyodor@nmap.org\n"); - if (p != numlst) - *p++ = ','; - sprintf(p, "%X", currenths->seq.timestamps[i]); - while (*p) - p++; + int n = Snprintf(p, remaining, "%s%X", + (p != numlst) ? "," : "", currenths->seq.timestamps[i]); + if (n >= remaining) + fatal("numlst overflow"); + p += n; + remaining -= n; } xml_open_start_tag("tcptssequence");