$OpenBSD: patch-libgputils_gparchive_c,v 1.4 2004/02/14 15:09:44 avsm Exp $
--- libgputils/gparchive.c.orig	2004-01-09 08:10:37.000000000 +0000
+++ libgputils/gparchive.c	2004-02-13 20:02:41.000000000 +0000
@@ -50,7 +50,7 @@ gp_archive_member_name(gp_archive_type *
   char name[256];
   char *end;
 
-  sscanf(archive->header.ar_name, "%s/", name);
+  sscanf(archive->header.ar_name, "%255s/", name);
   end = strchr(&name[0], '/');
   if (end != NULL) 
     *end = '\0';
@@ -73,7 +73,7 @@ gp_archive_list_members(gp_archive_type 
     archive = archive->next;
 
   while (archive != NULL) {
-    sscanf(archive->header.ar_name, "%s/", name);
+    sscanf(archive->header.ar_name, "%255s/", name);
     sscanf(archive->header.ar_date, "%il", &date);
     sscanf(archive->header.ar_size, "%il", &size);
     end = strchr(&name[0], '/');
@@ -99,7 +99,7 @@ gp_archive_find_member(gp_archive_type *
     archive = archive->next;
 
   while (archive != NULL) {
-    sscanf(archive->header.ar_name, "%s/", name);
+    sscanf(archive->header.ar_name, "%255s/", name);
     end = strrchr(&name[0], '/');
     if (end != NULL) 
       *end = '\0';
@@ -183,16 +183,16 @@ gp_archive_add_member(gp_archive_type *a
 
   timer = (int)time(NULL);
   
-  sprintf(name, "%s/", objectname);
-  sprintf(date, "%il", timer);
-  sprintf(size, "%lil", newobject->size);
+  snprintf(name, sizeof(name), "%s/", objectname);
+  snprintf(date, sizeof(date), "%il", timer);
+  snprintf(size, sizeof(size), "%lil", newobject->size);
 
   /* FIXME:  These functions over right the 0x20 that the header is filled 
      with. */ 
-  strncpy(&newmember->header.ar_name[0], &name[0], 256);
-  strncpy(&newmember->header.ar_date[0], &date[0], 12);
-  strncpy(&newmember->header.ar_size[0], &size[0], 10);
-  strncpy(&newmember->header.ar_fmag[0], ARMAG, 2);
+  strlcpy(newmember->header.ar_name, &name[0], sizeof(newmember->header.ar_name));
+  strlcpy(newmember->header.ar_date, &date[0], sizeof(newmember->header.ar_date));
+  strlcpy(newmember->header.ar_size, &size[0], sizeof(newmember->header.ar_size));
+  strlcpy(newmember->header.ar_fmag, ARMAG, sizeof(newmember->header.ar_fmag));
 
   oldmember = gp_archive_find_member(archive, objectname);
   
@@ -231,9 +231,9 @@ gp_archive_extract_member(gp_archive_typ
   /* if the object doesn't have an extension, add one.  This is done for
      some libs generated with other tools.  It should not be necessary
      for libs generated by gplib. */
-  strcpy(filename, objectname);
+  strlcpy(filename, objectname, sizeof(filename));
   if (strrchr(filename, '.') == NULL)
-    strcat(filename, ".o");
+    strlcat(filename, ".o", sizeof(filename));
 
   output_file = fopen(filename, "wb");
   if (output_file == NULL) {
@@ -413,7 +413,7 @@ gp_archive_make_index(gp_archive_type *a
     archive = archive->next;
         
   while (archive != NULL) {
-    sscanf(archive->header.ar_name, "%s/", name);
+    sscanf(archive->header.ar_name, "%255s/", name);
     end = strchr(&name[0], '/');
     if (end != NULL) 
       *end = '\0';
@@ -461,17 +461,25 @@ gp_archive_add_index(struct symbol_table
 
   /* create a new member for the index and place it in the archive */
   newmember = (gp_archive_type *)malloc(sizeof(*newmember));
+  if (!newmember) {
+    err(1, NULL);
+    exit(1);
+  }
   newmember->file = (char *)malloc(sizeof(char)*indexsize);
+  if(!newmember->file) {
+    err(1, NULL);
+    exit(1);
+  }
   newmember->next = NULL;  
 
   /* fill in the archive header */
   memset(&newmember->header, 0x20, AR_HDR_SIZ); /* fill the header with space */
 
   newmember->header.ar_name[0] = '/';
-  sprintf(size, "%lil", indexsize);
+  snprintf(size, sizeof(size), "%lil", indexsize);
 
-  strncpy(&newmember->header.ar_size[0], &size[0], 10);
-  strncpy(&newmember->header.ar_fmag[0], ARMAG, 2);
+  strlcpy(newmember->header.ar_size, &size[0], sizeof(newmember->header.ar_size));
+  strlcpy(newmember->header.ar_fmag, ARMAG, sizeof(newmember->header.ar_fmag));
 
   newmember->next = archive;
   archive = newmember;
@@ -494,8 +502,10 @@ gp_archive_add_index(struct symbol_table
 
   /* write the symbol names to the member */
   for (i = 0; i < table->count; i++) {
-    strcpy(ptr, get_symbol_name(lst[i]));
-    ptr += strlen(get_symbol_name(lst[i])) + 1;
+    const char*  symbol_name = get_symbol_name(lst[i]);
+    const size_t symbol_len  = strlen(symbol_name) + 1;
+    memcpy(ptr, symbol_name, symbol_len);
+    ptr += symbol_len;
   }
   
   return archive;
@@ -602,7 +612,7 @@ gp_archive_print_table(struct symbol_tab
     member = get_symbol_annotation(lst[i]);
     assert(member != NULL);
     /* determine the archive member name */
-    sscanf(member->header.ar_name, "%s/", name);
+    sscanf(member->header.ar_name, "%255s/", name);
     end = strchr(&name[0], '/');
     if (end != NULL) 
       *end = '\0';