foomatic-rip: use bounds-safe string writes (#697) (#707)

Replace the strcpy/sprintf calls CodeQL flagged as unbounded writes with
bounded equivalents: strlcpy for opt->varname, snprintf for the command
fragment, and memcpy(srclen+1) in dstrcpy(). Behaviour is unchanged - the
destinations were already sized correctly - but the bounds are now
explicit.

Addresses #697

diff --git a/filter/foomatic-rip/options.c b/filter/foomatic-rip/options.c
index b8c258694e686b28bb2ab80a75ebfe6f70dca0e1..ca80e94bce3885f5cbb5db5b939d8a61cce5e466 100644 (file)
--- a/filter/foomatic-rip/options.c
+++ b/filter/foomatic-rip/options.c
@@ -423,7 +423,7 @@ assure_option(const char *name)
     strlcpy(opt->name, name, 128);
 
   // set varname
-  strcpy(opt->varname, opt->name);
+  strlcpy(opt->varname, opt->name, sizeof(opt->varname));
   strrepl(opt->varname, "-/.", '_');
 
   // Default execution style is 'G' (PostScript) since all arguments for
@@ -2463,8 +2463,9 @@ build_commandline(int optset,
     {
       if (isempty(userval))
        continue;
-      s = malloc(strlen(opt->name) + strlen(userval) + 20);
-      sprintf(s, "%s=%s %%Y", opt->name, userval);
+      size_t s_size = strlen(opt->name) + strlen(userval) + 20;
+      s = malloc(s_size);
+      snprintf(s, s_size, "%s=%s %%Y", opt->name, userval);
       dstrreplace(cmdline, "%Y", s, 0);
       free(s);
     }

diff --git a/filter/foomatic-rip/util.c b/filter/foomatic-rip/util.c
index dfa1205e0b7ce044262865d017238596a3583393..75cafca17a624d06f8977854afd8e15d8aff9331 100644 (file)
--- a/filter/foomatic-rip/util.c
+++ b/filter/foomatic-rip/util.c
@@ -850,7 +850,7 @@ dstrcpy(dstr_t *ds,
     ds->data = realloc(ds->data, ds->alloc);
   }
 
-  strcpy(ds->data, src);
+  memcpy(ds->data, src, srclen + 1);
   ds->len = srclen;
 }