libfdisk: use snprintf() instead of sprintf()

Signed-off-by: Karel Zak <kzak@redhat.com>

diff --git a/libfdisk/src/gpt.c b/libfdisk/src/gpt.c
index 8a052852a186e31b81f5e47c1380cc577534dd1f..298c88a52435ae6ba70974da0bca7135185c3143 100644 (file)
--- a/libfdisk/src/gpt.c
+++ b/libfdisk/src/gpt.c
@@ -1736,7 +1736,7 @@ static char *encode_to_utf8(unsigned char *src, size_t count)
 static int gpt_entry_attrs_to_string(struct gpt_entry *e, char **res)
 {
        unsigned int n, count = 0;
-       size_t l;
+       size_t l, res_size;
        char *bits, *p;
        uint64_t attrs;
 
@@ -1752,10 +1752,11 @@ static int gpt_entry_attrs_to_string(struct gpt_entry *e, char **res)
 
        /* Note that sizeof() is correct here, we need separators between
         * the strings so also count \0 is correct */
-       *res = calloc(1, sizeof(GPT_ATTRSTR_NOBLOCK) +
+       res_size = sizeof(GPT_ATTRSTR_NOBLOCK) +
                         sizeof(GPT_ATTRSTR_REQ) +
                         sizeof(GPT_ATTRSTR_LEGACY) +
-                        sizeof("GUID:") + (GPT_ATTRBIT_GUID_COUNT * 3));
+                        sizeof("GUID:") + (GPT_ATTRBIT_GUID_COUNT * 3);
+       *res = calloc(1, res_size);
        if (!*res)
                return -errno;
 
@@ -1779,15 +1780,20 @@ static int gpt_entry_attrs_to_string(struct gpt_entry *e, char **res)
 
        for (n = GPT_ATTRBIT_GUID_FIRST;
             n < GPT_ATTRBIT_GUID_FIRST + GPT_ATTRBIT_GUID_COUNT; n++) {
+               int rc;
 
                if (!isset(bits, n))
                        continue;
                if (!count) {
                        if (p != *res)
                                *p++ = ' ';
-                       p += sprintf(p, "GUID:%u", n);
+                       rc = snprintf(p, res_size - (p - *res), "GUID:%u", n);
                } else
-                       p += sprintf(p, ",%u", n);
+                       rc = snprintf(p, res_size - (p - *res), ",%u", n);
+
+               if (rc < 0 || (size_t) rc >= res_size - (p - *res))
+                       break;
+               p += rc;
                count++;
        }