don't use sprintf. It's not guaranteed to not scribble over memory.

base/remote_gdb.cc:
    use snprintf, it's safer
dev/ide_disk.cc:
    use strncpy instead of snprintf

--HG--
extra : convert_revision : 90455e3f6bcb4c771724298a5a0b79a5b483a85c

diff --git a/base/remote_gdb.cc b/base/remote_gdb.cc
index 3685b05d18ea4475981509bb64dd8ccf71948737..17331fcd9b2776182ba5246d98429e16a228dbdc 100644 (file)
--- a/base/remote_gdb.cc
+++ b/base/remote_gdb.cc
@@ -834,7 +834,7 @@ RemoteGDB::trap(int type)
         active = true;
     else
         // Tell remote host that an exception has occurred.
-        sprintf((char *)buffer, "S%02x", signal(type));
+        snprintf((char *)buffer, sizeof(buffer), "S%02x", signal(type));
         send(buffer);
 
     // Stick frame regs into our reg cache.
@@ -852,7 +852,7 @@ RemoteGDB::trap(int type)
             // if this command came from a running gdb, answer it --
             // the other guy has no way of knowing if we're in or out
             // of this loop when he issues a "remote-signal".
-            sprintf((char *)buffer, "S%02x", signal(type));
+            snprintf((char *)buffer, sizeof(buffer), "S%02x", signal(type));
             send(buffer);
             continue;
 

diff --git a/dev/ide_disk.cc b/dev/ide_disk.cc
index bd9aac8ea3cdcbd015512cd94c5f2f1607803a14..f178e44ed0cad948f7b1e22fd5f5c072547389bf 100644 (file)
--- a/dev/ide_disk.cc
+++ b/dev/ide_disk.cc
@@ -92,7 +92,8 @@ IdeDisk::IdeDisk(const string &name, DiskImage *img, PhysicalMemory *phys,
     }
 
     // Setup the model name
-    sprintf((char *)driveID.atap_model, "5MI EDD si k");
+    strncpy((char *)driveID.atap_model, "5MI EDD si k",
+            sizeof(driveID.atap_model));
     // Set the maximum multisector transfer size
     driveID.atap_multi = MAX_MULTSECT;
     // IORDY supported, IORDY disabled, LBA enabled, DMA enabled