Reduced quantities of data that could be written to a few buffers.

gcc 8 noticed that snprintfs could have overrun the buffers.

diff --git a/uip/distsbr.c b/uip/distsbr.c
index d0db94b266d782b3c3aa1d3f1d70a56543fd278d..f6f54d9f2a33d229735aa0672060c124533b73c3 100644 (file)
--- a/uip/distsbr.c
+++ b/uip/distsbr.c
@@ -59,9 +59,11 @@ distout (char *drft, char *msgnam, char *backup)
            case FLD: 
            case FLDPLUS: 
                if (uprf (name, "distribute-"))
            case FLD: 
            case FLDPLUS: 
                if (uprf (name, "distribute-"))

-                   snprintf (name, sizeof(name), "%s%s", "Resent", &name[10]);
+                   snprintf (name, sizeof(name), "%s%.*s", "Resent", NAMESZ-7,
+                             &name[10]);

                if (uprf (name, "distribution-"))
                if (uprf (name, "distribution-"))

-                   snprintf (name, sizeof(name), "%s%s", "Resent", &name[12]);
+                   snprintf (name, sizeof(name), "%s%.*s", "Resent", NAMESZ-7,
+                             &name[12]);

                if (!uprf (name, "resent")) {
                    inform(BADHDR, "draft", name);
                    goto leave_bad;
                if (!uprf (name, "resent")) {
                    inform(BADHDR, "draft", name);
                    goto leave_bad;

diff --git a/uip/dropsbr.c b/uip/dropsbr.c
index 0029f0745436dc79433159cde705240657409d55..630de11181615b892b8c2d8bd7584455ed79ccc9 100644 (file)
--- a/uip/dropsbr.c
+++ b/uip/dropsbr.c
@@ -247,7 +247,7 @@ mbx_copy (char *mailbox, int mbx_style, int md, int fd,
                         * If there is already a "From " line,
                         * then leave it alone.  Else we add one.
                         */
                         * If there is already a "From " line,
                         * then leave it alone.  Else we add one.
                         */

-                       char tmpbuffer[sizeof buffer];
+                       char tmpbuffer[sizeof buffer-7];

                        char *tp, *ep;
 
                        strncpy(tmpbuffer, buffer, sizeof(tmpbuffer));
                        char *tp, *ep;
 
                        strncpy(tmpbuffer, buffer, sizeof(tmpbuffer));