$OpenBSD: patch-gnats_files_c,v 1.2 2007/12/28 17:11:25 espie Exp $
--- gnats/files.c.orig	Sun Feb 11 22:36:25 2001
+++ gnats/files.c	Fri Dec 28 18:00:24 2007
@@ -41,7 +41,7 @@ find_submitter (cptr, site)
   if (site == NULL)
     return -1;
 
-  sprintf (path, "%s/gnats-adm/%s", gnats_root, SUBMITTERS);
+  snprintf (path, PATH_MAX, "%s/gnats-adm/%s", gnats_root, SUBMITTERS);
   err = get_adm_record (path, array, site);
 
   if (err == -1) 
@@ -87,7 +87,7 @@ find_category (cptr, category)
   char **array = (char **) alloca (NUM_CATEGORY_FIELDS * sizeof (char *));
   int err;
 
-  sprintf (path, "%s/gnats-adm/%s", gnats_root, CATEGORIES);
+  snprintf (path, PATH_MAX, "%s/gnats-adm/%s", gnats_root, CATEGORIES);
   err = get_adm_record (path, array, category);
 
   if (err == -1)
@@ -143,7 +143,7 @@ find_responsible (responsible, person)
 	 we don't end up with garbage.  */
       memset (array, 0, NUM_RESPONSIBLE_FIELDS * sizeof (char *));
 
-      sprintf (path, "%s/gnats-adm/%s", gnats_root, RESPONSIBLE_FILE);
+      snprintf (path, PATH_MAX, "%s/gnats-adm/%s", gnats_root, RESPONSIBLE_FILE);
       err = get_adm_record (path, array, person);
       xfree (path);
       if (err == -1)
@@ -177,13 +177,15 @@ get_adm_record (fname, ptr, key)
   char line[STR_MAX], temp[STR_MAX];
   char *l, *l2;
   char *keyed;
+  size_t keyedsize;
   int err = -1, keyedlen;
 
   /* append a delimiting ':' to the end of sting to make sure the match
      is fully correct.  */
-  keyed = (char *) alloca (strlen(key) + 2);
-  /* which is slower - strcpy/strcat or sprintf? */
-  sprintf (keyed, "%s:", key);
+  keyedsize = strlen(key) + 2;
+  keyed = (char *) alloca (keyedsize);
+  /* which is slower - strlcpy/strlcat or snprintf? */
+  snprintf (keyed, keyedsize, "%s:", key);
   keyedlen = strlen(keyed); 
 
   fp = fopen (fname,"r");
@@ -271,7 +273,7 @@ init_responsibles ()
   char *path = (char *) alloca (PATH_MAX);
 
   memset (array, 0, NUM_RESPONSIBLE_FIELDS * sizeof (char *));
-  sprintf (path, "%s/gnats-adm/%s", gnats_root, RESPONSIBLE_FILE);
+  snprintf (path, PATH_MAX, "%s/gnats-adm/%s", gnats_root, RESPONSIBLE_FILE);
   fp = fopen (path, "r");
   if (fp == NULL)
     return 0;
@@ -358,7 +360,7 @@ init_classes ()
   int  i, nerrs = 0;
 
   memset (array, 0, NUM_CLASS_FIELDS * sizeof (char *));
-  sprintf (path, "%s/gnats-adm/%s", gnats_root, CLASSES);
+  snprintf (path, PATH_MAX, "%s/gnats-adm/%s", gnats_root, CLASSES);
   fp = fopen (path, "r");
 
   if (fp == NULL)
@@ -549,11 +551,11 @@ get_class_enum_field ()
   line = xmalloc (totlen * sizeof(char)); 
   line[0] = '\0';
   c = class_chain;
-  strcat (line, c->key);
+  strlcat (line, c->key, totlen);
   for (c = c->next; c; c = c->next)
     {
-      strcat (line,  " | ");
-      strcat (line, c->key);
+      strlcat (line,  " | ", totlen);
+      strlcat (line, c->key, totlen);
     }
   return line;
 }
@@ -593,7 +595,7 @@ init_states ()
   int  i, nerrs = 0;
 
   memset (array, 0, NUM_STATE_FIELDS * sizeof (char *));
-  sprintf (path, "%s/gnats-adm/%s", gnats_root, STATES);
+  snprintf (path, PATH_MAX, "%s/gnats-adm/%s", gnats_root, STATES);
   fp = fopen (path, "r");
 
   if (fp == NULL)
@@ -779,11 +781,11 @@ get_state_enum_field ()
   char line[STR_MAX];
   line[0] = '\0';
   s = state_chain;
-  strcat (line, s->key);
+  strlcat (line, s->key, sizeof(line));
   for (s = s->next; s; s = s->next)
     {
-      strcat (line,  " | ");
-      strcat (line, s->key);
+      strlcat (line,  " | ", sizeof(line));
+      strlcat (line, s->key, sizeof(line));
     }
   return (strdup (line));
 }
@@ -901,7 +903,7 @@ get_responsible_addr (full, strict, name)
     {
       address = (char *) xmalloc (STR_MAX);
       if (full)
-	sprintf (address, "%s:%s:%s", r->key, r->fullname, r->alias);
+	snprintf (address, STR_MAX, "%s:%s:%s", r->key, r->fullname, r->alias);
       else
 	{
 	  if (r->alias[0]
@@ -909,9 +911,9 @@ get_responsible_addr (full, strict, name)
 		 added a space after the colon, we don't accept that as
 		 an address.  */
 	      && isalpha (r->alias[0]))
-	    sprintf (address, "%s", r->alias);
+	    snprintf (address, STR_MAX, "%s", r->alias);
 	  else
-	    sprintf (address, "%s", r->key);
+	    snprintf (address, STR_MAX, "%s", r->key);
 	}
     }