1 files changed, 21 insertions, 15 deletions

diff --git a/src/lib/libcrypto/bio/bio_cb.c b/src/lib/libcrypto/bio/bio_cb.c
index 0ffa4d2136..ee9159ebd8 100644
--- a/src/lib/libcrypto/bio/bio_cb.c
+++ b/src/lib/libcrypto/bio/bio_cb.c
@@ -70,55 +70,61 @@ long MS_CALLBACK BIO_debug_callback(BIO *bio, int cmd, const char *argp,
         MS_STATIC char buf[256];
         char *p;
         long r=1;
+        size_t p_maxlen;
 
         if (BIO_CB_RETURN & cmd)
                 r=ret;
 
-        sprintf(buf,"BIO[%08lX]:",(unsigned long)bio);
+        snprintf(buf,sizeof buf,"BIO[%08lX]:",(unsigned long)bio);
         p= &(buf[14]);
+        p_maxlen = sizeof buf - 14;
         switch (cmd)
                 {
         case BIO_CB_FREE:
-                sprintf(p,"Free - %s\n",bio->method->name);
+                snprintf(p,p_maxlen,"Free - %s\n",bio->method->name);
                 break;
         case BIO_CB_READ:
                 if (bio->method->type & BIO_TYPE_DESCRIPTOR)
-                        sprintf(p,"read(%d,%d) - %s fd=%d\n",bio->num,argi,bio->method->name,bio->num);
+                        snprintf(p,p_maxlen,"read(%d,%d) - %s fd=%d\n",
+                                 bio->num,argi,bio->method->name,bio->num);
                 else
-                        sprintf(p,"read(%d,%d) - %s\n",bio->num,argi,bio->method->name);
+                        snprintf(p,p_maxlen,"read(%d,%d) - %s\n",
+                                 bio->num,argi,bio->method->name);
                 break;
         case BIO_CB_WRITE:
                 if (bio->method->type & BIO_TYPE_DESCRIPTOR)
-                        sprintf(p,"write(%d,%d) - %s fd=%d\n",bio->num,argi,bio->method->name,bio->num);
+                        snprintf(p,p_maxlen,"write(%d,%d) - %s fd=%d\n",
+                                 bio->num,argi,bio->method->name,bio->num);
                 else
-                        sprintf(p,"write(%d,%d) - %s\n",bio->num,argi,bio->method->name);
+                        snprintf(p,p_maxlen,"write(%d,%d) - %s\n",
+                                 bio->num,argi,bio->method->name);
                 break;
         case BIO_CB_PUTS:
-                sprintf(p,"puts() - %s\n",bio->method->name);
+                snprintf(p,p_maxlen,"puts() - %s\n",bio->method->name);
                 break;
         case BIO_CB_GETS:
-                sprintf(p,"gets(%d) - %s\n",argi,bio->method->name);
+                snprintf(p,p_maxlen,"gets(%d) - %s\n",argi,bio->method->name);
                 break;
         case BIO_CB_CTRL:
-                sprintf(p,"ctrl(%d) - %s\n",argi,bio->method->name);
+                snprintf(p,p_maxlen,"ctrl(%d) - %s\n",argi,bio->method->name);
                 break;
         case BIO_CB_RETURN|BIO_CB_READ:
-                sprintf(p,"read return %ld\n",ret);
+                snprintf(p,p_maxlen,"read return %ld\n",ret);
                 break;
         case BIO_CB_RETURN|BIO_CB_WRITE:
-                sprintf(p,"write return %ld\n",ret);
+                snprintf(p,p_maxlen,"write return %ld\n",ret);
                 break;
         case BIO_CB_RETURN|BIO_CB_GETS:
-                sprintf(p,"gets return %ld\n",ret);
+                snprintf(p,p_maxlen,"gets return %ld\n",ret);
                 break;
         case BIO_CB_RETURN|BIO_CB_PUTS:
-                sprintf(p,"puts return %ld\n",ret);
+                snprintf(p,p_maxlen,"puts return %ld\n",ret);
                 break;
         case BIO_CB_RETURN|BIO_CB_CTRL:
-                sprintf(p,"ctrl return %ld\n",ret);
+                snprintf(p,p_maxlen,"ctrl return %ld\n",ret);
                 break;
         default:
-                sprintf(p,"bio callback - unknown type (%d)\n",cmd);
+                snprintf(p,p_maxlen,"bio callback - unknown type (%d)\n",cmd);
                 break;
                 }