* dbusbind.c (xd_signature, Fdbus_register_signal):

Do not overrun buffer; instead, report string overflow.

diff --git a/src/ChangeLog b/src/ChangeLog
index d60c57dfd53aa3da15539c86bd5d50f834434248..307174268bcedb327d852b972ac6680a783c6424 100644 (file)
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -20,6 +20,9 @@
        (esprintf, esnprintf, exprintf, evxprintf): New decls.
        * window.h (command_loop_level, minibuf_level): Reflect API changes.
 
+       * dbusbind.c (xd_signature, Fdbus_register_signal):
+       Do not overrun buffer; instead, report string overflow.
+
 2011-08-26  Paul Eggert  <eggert@cs.ucla.edu>
 
        Integer and memory overflow issues (Bug#9196).

diff --git a/src/dbusbind.c b/src/dbusbind.c
index 4828f4e968dcda6e3a42960394c30ac55f56527a..005d521c1db6386cff0cbcf1978e4edac89312a9 100644 (file)
--- a/src/dbusbind.c
+++ b/src/dbusbind.c
@@ -271,6 +271,7 @@ xd_signature (char *signature, unsigned int dtype, unsigned int parent_type, Lis
 {
   unsigned int subtype;
   Lisp_Object elt;
+  char const *subsig;
   char x[DBUS_MAXIMUM_SIGNATURE_LENGTH];
 
   elt = object;
@@ -328,12 +329,13 @@ xd_signature (char *signature, unsigned int dtype, unsigned int parent_type, Lis
       if (NILP (elt))
        {
          subtype = DBUS_TYPE_STRING;
-         strcpy (x, DBUS_TYPE_STRING_AS_STRING);
+         subsig = DBUS_TYPE_STRING_AS_STRING;
        }
       else
        {
          subtype = XD_OBJECT_TO_DBUS_TYPE (CAR_SAFE (elt));
          xd_signature (x, subtype, dtype, CAR_SAFE (XD_NEXT_VALUE (elt)));
+         subsig = x;
        }
 
       /* If the element type is DBUS_TYPE_SIGNATURE, and this is the
@@ -342,7 +344,7 @@ xd_signature (char *signature, unsigned int dtype, unsigned int parent_type, Lis
       if ((subtype == DBUS_TYPE_SIGNATURE)
          && STRINGP (CAR_SAFE (XD_NEXT_VALUE (elt)))
          && NILP (CDR_SAFE (XD_NEXT_VALUE (elt))))
-       strcpy (x, SSDATA (CAR_SAFE (XD_NEXT_VALUE (elt))));
+       subsig = SSDATA (CAR_SAFE (XD_NEXT_VALUE (elt)));
 
       while (!NILP (elt))
        {
@@ -351,7 +353,10 @@ xd_signature (char *signature, unsigned int dtype, unsigned int parent_type, Lis
          elt = CDR_SAFE (XD_NEXT_VALUE (elt));
        }
 
-      sprintf (signature, "%c%s", dtype, x);
+      if (esnprintf (signature, DBUS_MAXIMUM_SIGNATURE_LENGTH,
+                    "%c%s", dtype, subsig)
+         == DBUS_MAXIMUM_SIGNATURE_LENGTH - 1)
+       string_overflow ();
       break;
 
     case DBUS_TYPE_VARIANT:
@@ -2026,7 +2031,7 @@ usage: (dbus-register-signal BUS SERVICE PATH INTERFACE SIGNAL HANDLER &rest ARG
   DBusConnection *connection;
   ptrdiff_t i;
   char rule[DBUS_MAXIMUM_MATCH_RULE_LENGTH];
-  char x[DBUS_MAXIMUM_MATCH_RULE_LENGTH];
+  int rulelen;
   DBusError derror;
 
   /* Check parameters.  */
@@ -2071,34 +2076,32 @@ usage: (dbus-register-signal BUS SERVICE PATH INTERFACE SIGNAL HANDLER &rest ARG
       connection = xd_initialize (bus, TRUE);
 
       /* Create a rule to receive related signals.  */
-      sprintf (rule,
-              "type='signal',interface='%s',member='%s'",
-              SDATA (interface),
-              SDATA (signal));
+      rulelen = esnprintf (rule, sizeof rule,
+                          "type='signal',interface='%s',member='%s'",
+                          SDATA (interface),
+                          SDATA (signal));
 
       /* Add unique name and path to the rule if they are non-nil.  */
       if (!NILP (uname))
-       {
-         sprintf (x, ",sender='%s'", SDATA (uname));
-         strcat (rule, x);
-       }
+       rulelen += esnprintf (rule + rulelen, sizeof rule - rulelen,
+                             ",sender='%s'", SDATA (uname));
 
       if (!NILP (path))
-       {
-         sprintf (x, ",path='%s'", SDATA (path));
-         strcat (rule, x);
-       }
+       rulelen += esnprintf (rule + rulelen, sizeof rule - rulelen,
+                             ",path='%s'", SDATA (path));
 
       /* Add arguments to the rule if they are non-nil.  */
       for (i = 6; i < nargs; ++i)
        if (!NILP (args[i]))
          {
            CHECK_STRING (args[i]);
-           sprintf (x, ",arg%"pD"d='%s'", i - 6,
-                    SDATA (args[i]));
-           strcat (rule, x);
+           rulelen += esnprintf (rule + rulelen, sizeof rule - rulelen,
+                                 ",arg%"pD"d='%s'", i - 6, SDATA (args[i]));
          }
 
+      if (rulelen == sizeof rule - 1)
+       string_overflow ();
+
       /* Add the rule to the bus.  */
       dbus_error_init (&derror);
       dbus_bus_add_match (connection, rule, &derror);