Ignore:
Timestamp:
Feb 28, 2010, 9:59:12 PM (11 years ago)
Author:
jmr@…
Message:

error checking, sprintf -> snprintf, strcpy -> strncpy

File:
1 edited

Legend:

Unmodified
Added
Removed
  • trunk/base/src/registry2.0/item.c

    r27967 r64294  
    151151    Tcl_Obj* result;
    152152    /* 40 + 20 per clause is safe */
    153     char* query = (char*)malloc((20*objc)*sizeof(char));
     153    int query_size = (20*objc)*sizeof(char);
     154    char* query = (char*)malloc(query_size);
     155    char* query_start = "SELECT proc FROM items";
    154156    char* insert;
     157    int insert_size = query_size - strlen(query_start);
    155158    if (db == NULL) {
    156159        return TCL_ERROR;
    157160    }
    158     strcpy(query, "SELECT proc FROM items");
    159     insert = query + strlen("SELECT proc FROM items");
     161    strncpy(query, query_start, query_size);
     162    insert = query + strlen(query_start);
    160163    for (i=2; i<objc; i++) {
    161164        int len;
     
    180183        key = Tcl_GetString(keyObj);
    181184        if (i == 2) {
    182             sprintf(insert, " WHERE %s=?", key);
     185            snprintf(insert, insert_size, " WHERE %s=?", key);
    183186            insert += 9 + strlen(key);
     187            insert_size -= 9 + strlen(key);
    184188        } else {
    185             sprintf(insert, " AND %s=?", key);
     189            snprintf(insert, insert_size, " AND %s=?", key);
    186190            insert += 7 + strlen(key);
     191            insert_size -= 7 + strlen(key);
    187192        }
    188193    }
Note: See TracChangeset for help on using the changeset viewer.