From 11d1a190530f85a361a1b3835f57d635256dff1a Mon Sep 17 00:00:00 2001
From: Aayush Kumar <166936037+AayushKumar26@users.noreply.github.com>
Date: Wed, 22 Jul 2026 02:45:22 +0530
Subject: [PATCH] foomatic-rip: use bounds-safe string writes (#697) (#707)

Replace the strcpy/sprintf calls CodeQL flagged as unbounded writes with
bounded equivalents: strlcpy for opt->varname, snprintf for the command
fragment, and memcpy(srclen+1) in dstrcpy(). Behaviour is unchanged - the
destinations were already sized correctly - but the bounds are now
explicit.

Addresses #697
---
 filter/foomatic-rip/options.c | 7 ++++---
 filter/foomatic-rip/util.c    | 2 +-
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/filter/foomatic-rip/options.c b/filter/foomatic-rip/options.c
index b8c258694..ca80e94bc 100644
--- a/filter/foomatic-rip/options.c
+++ b/filter/foomatic-rip/options.c
@@ -423,7 +423,7 @@ assure_option(const char *name)
     strlcpy(opt->name, name, 128);
 
   // set varname
-  strcpy(opt->varname, opt->name);
+  strlcpy(opt->varname, opt->name, sizeof(opt->varname));
   strrepl(opt->varname, "-/.", '_');
 
   // Default execution style is 'G' (PostScript) since all arguments for
@@ -2463,8 +2463,9 @@ build_commandline(int optset,
     {
       if (isempty(userval))
 	continue;
-      s = malloc(strlen(opt->name) + strlen(userval) + 20);
-      sprintf(s, "%s=%s %%Y", opt->name, userval);
+      size_t s_size = strlen(opt->name) + strlen(userval) + 20;
+      s = malloc(s_size);
+      snprintf(s, s_size, "%s=%s %%Y", opt->name, userval);
       dstrreplace(cmdline, "%Y", s, 0);
       free(s);
     }
diff --git a/filter/foomatic-rip/util.c b/filter/foomatic-rip/util.c
index dfa1205e0..75cafca17 100644
--- a/filter/foomatic-rip/util.c
+++ b/filter/foomatic-rip/util.c
@@ -850,7 +850,7 @@ dstrcpy(dstr_t *ds,
     ds->data = realloc(ds->data, ds->alloc);
   }
 
-  strcpy(ds->data, src);
+  memcpy(ds->data, src, srclen + 1);
   ds->len = srclen;
 }
 
-- 
2.47.3