[125678kqv][cl]: fix sprint() and strcpy() buffer overflows

1 files changed, 43 insertions, 38 deletions

diff --git a/sys/src/cmd/kl/list.c b/sys/src/cmd/kl/list.c
index 00fcb7ee4..b389ab2f5 100644
--- a/sys/src/cmd/kl/list.c
+++ b/sys/src/cmd/kl/list.c
@@ -20,7 +20,7 @@ prasm(Prog *p)
 int
 Pconv(Fmt *fp)
 {
-	char str[STRINGSZ], *s;
+	char str[STRINGSZ];
 	Prog *p;
 	int a;
 
@@ -28,26 +28,31 @@ Pconv(Fmt *fp)
 	curp = p;
 	a = p->as;
 	if(a == ADATA || a == AINIT || a == ADYNT)
-		sprint(str, "	%A	%D/%d,%D", a, &p->from, p->reg, &p->to);
+		snprint(str, sizeof str, "	%A	%D/%d,%D", a, &p->from, p->reg, &p->to);
 	else{
-		s = str;
-		if(p->mark & NOSCHED)
-			s += sprint(s, "*");
 		if(p->reg == NREG)
-			sprint(s, "	%A	%D,%D", a, &p->from, &p->to);
+			snprint(str, sizeof str, "%s	%A	%D,%D",
+				p->mark & NOSCHED ? "*" : "", a, 
+				&p->from, &p->to);
 		else
 		if(p->from.type == D_OREG) {
-			sprint(s, "	%A	%ld(R%d+R%d),%D", a,
+			snprint(str, sizeof str, "%s	%A	%ld(R%d+R%d),%D",
+				p->mark & NOSCHED ? "*" : "", a, 
 				p->from.offset, p->from.reg, p->reg, &p->to);
 		} else
 		if(p->to.type == D_OREG) {
-			sprint(s, "	%A	%D,%ld(R%d+R%d)", a,
+			snprint(str, sizeof str, "%s	%A	%D,%ld(R%d+R%d)",
+				p->mark & NOSCHED ? "*" : "", a, 
 				&p->from, p->to.offset, p->to.reg, p->reg);
 		} else
 		if(p->from.type == D_FREG)
-			sprint(s, "	%A	%D,F%d,%D", a, &p->from, p->reg, &p->to);
+			snprint(str, sizeof str, "%s	%A	%D,F%d,%D",
+				p->mark & NOSCHED ? "*" : "", a, 
+				&p->from, p->reg, &p->to);
 		else
-			sprint(s, "	%A	%D,R%d,%D", a, &p->from, p->reg, &p->to);
+			snprint(str, sizeof str, "%s	%A	%D,R%d,%D",
+				p->mark & NOSCHED ? "*" : "", a, 
+				&p->from, p->reg, &p->to);
 	}
 	return fmtstrcpy(fp, str);
 }
@@ -76,58 +81,58 @@ Dconv(Fmt *fp)
 	switch(a->type) {
 
 	default:
-		sprint(str, "GOK-type(%d)", a->type);
+		snprint(str, sizeof str, "GOK-type(%d)", a->type);
 		break;
 
 	case D_NONE:
 		str[0] = 0;
 		if(a->name != D_NONE || a->reg != NREG || a->sym != S)
-			sprint(str, "%N(R%d)(NONE)", a, a->reg);
+			snprint(str, sizeof str, "%N(R%d)(NONE)", a, a->reg);
 		break;
 
 	case D_CONST:
 		if(a->reg != NREG)
-			sprint(str, "$%N(R%d)", a, a->reg);
+			snprint(str, sizeof str, "$%N(R%d)", a, a->reg);
 		else
-			sprint(str, "$%N", a);
+			snprint(str, sizeof str, "$%N", a);
 		break;
 
 	case D_ASI:
 		if(a->reg != NREG)
-			sprint(str, "(R%d,%ld)", a->reg, a->offset);
+			snprint(str, sizeof str, "(R%d,%ld)", a->reg, a->offset);
 		else
-			sprint(str, "(R%d,%ld)", 0, a->offset);
+			snprint(str, sizeof str, "(R%d,%ld)", 0, a->offset);
 		break;
 
 	case D_OREG:
 		if(a->reg != NREG)
-			sprint(str, "%N(R%d)", a, a->reg);
+			snprint(str, sizeof str, "%N(R%d)", a, a->reg);
 		else
-			sprint(str, "%N", a);
+			snprint(str, sizeof str, "%N", a);
 		break;
 
 	case D_REG:
-		sprint(str, "R%d", a->reg);
+		snprint(str, sizeof str, "R%d", a->reg);
 		if(a->name != D_NONE || a->sym != S)
-			sprint(str, "%N(R%d)(REG)", a, a->reg);
+			snprint(str, sizeof str, "%N(R%d)(REG)", a, a->reg);
 		break;
 
 	case D_FREG:
-		sprint(str, "F%d", a->reg);
+		snprint(str, sizeof str, "F%d", a->reg);
 		if(a->name != D_NONE || a->sym != S)
-			sprint(str, "%N(F%d)(REG)", a, a->reg);
+			snprint(str, sizeof str, "%N(F%d)(REG)", a, a->reg);
 		break;
 
 	case D_CREG:
-		sprint(str, "C%d", a->reg);
+		snprint(str, sizeof str, "C%d", a->reg);
 		if(a->name != D_NONE || a->sym != S)
-			sprint(str, "%N(C%d)(REG)", a, a->reg);
+			snprint(str, sizeof str, "%N(C%d)(REG)", a, a->reg);
 		break;
 
 	case D_PREG:
-		sprint(str, "P%d", a->reg);
+		snprint(str, sizeof str, "P%d", a->reg);
 		if(a->name != D_NONE || a->sym != S)
-			sprint(str, "%N(P%d)(REG)", a, a->reg);
+			snprint(str, sizeof str, "%N(P%d)(REG)", a, a->reg);
 		break;
 
 	case D_BRANCH:
@@ -136,22 +141,22 @@ Dconv(Fmt *fp)
 			if(v >= INITTEXT)
 				v -= INITTEXT-HEADR;
 			if(a->sym != S)
-				sprint(str, "%s+%.5lux(BRANCH)", a->sym->name, v);
+				snprint(str, sizeof str, "%s+%.5lux(BRANCH)", a->sym->name, v);
 			else
-				sprint(str, "%.5lux(BRANCH)", v);
+				snprint(str, sizeof str, "%.5lux(BRANCH)", v);
 		} else
 			if(a->sym != S)
-				sprint(str, "%s+%ld(APC)", a->sym->name, a->offset);
+				snprint(str, sizeof str, "%s+%ld(APC)", a->sym->name, a->offset);
 			else
-				sprint(str, "%ld(APC)", a->offset);
+				snprint(str, sizeof str, "%ld(APC)", a->offset);
 		break;
 
 	case D_FCONST:
-		sprint(str, "$%lux-%lux", a->ieee.h, a->ieee.l);
+		snprint(str, sizeof str, "$%lux-%lux", a->ieee.h, a->ieee.l);
 		break;
 
 	case D_SCONST:
-		sprint(str, "$\"%S\"", a->sval);
+		snprint(str, sizeof str, "$\"%S\"", a->sval);
 		break;
 	}
 	return fmtstrcpy(fp, str);
@@ -167,28 +172,28 @@ Nconv(Fmt *fp)
 	a = va_arg(fp->args, Adr*);
 	s = a->sym;
 	if(s == S) {
-		sprint(str, "%ld", a->offset);
+		snprint(str, sizeof str, "%ld", a->offset);
 		goto out;
 	}
 	switch(a->name) {
 	default:
-		sprint(str, "GOK-name(%d)", a->name);
+		snprint(str, sizeof str, "GOK-name(%d)", a->name);
 		break;
 
 	case D_EXTERN:
-		sprint(str, "%s+%ld(SB)", s->name, a->offset);
+		snprint(str, sizeof str, "%s+%ld(SB)", s->name, a->offset);
 		break;
 
 	case D_STATIC:
-		sprint(str, "%s<>+%ld(SB)", s->name, a->offset);
+		snprint(str, sizeof str, "%s<>+%ld(SB)", s->name, a->offset);
 		break;
 
 	case D_AUTO:
-		sprint(str, "%s-%ld(SP)", s->name, -a->offset);
+		snprint(str, sizeof str, "%s-%ld(SP)", s->name, -a->offset);
 		break;
 
 	case D_PARAM:
-		sprint(str, "%s+%ld(FP)", s->name, a->offset);
+		snprint(str, sizeof str, "%s+%ld(FP)", s->name, a->offset);
 		break;
 	}
 out: