6 files changed, 59 insertions, 49 deletions

diff --git a/src/lib/libcrypto/bio/b_dump.c b/src/lib/libcrypto/bio/b_dump.c
index 8397cfab6a..f671e722fa 100644
--- a/src/lib/libcrypto/bio/b_dump.c
+++ b/src/lib/libcrypto/bio/b_dump.c
@@ -104,38 +104,41 @@ int BIO_dump_indent(BIO *bio, const char *s, int len, int indent)
         for(i=0;i<rows;i++)
                 {
                 buf[0]='\0';    /* start with empty string */
-                strcpy(buf,str);
-                sprintf(tmp,"%04x - ",i*dump_width);
-                strcat(buf,tmp);
+                BUF_strlcpy(buf,str,sizeof buf);
+                BIO_snprintf(tmp,sizeof tmp,"%04x - ",i*dump_width);
+                BUF_strlcat(buf,tmp,sizeof buf);
                 for(j=0;j<dump_width;j++)
                         {
                         if (((i*dump_width)+j)>=len)
                                 {
-                                strcat(buf,"   ");
+                                BUF_strlcat(buf,"   ",sizeof buf);
                                 }
                         else
                                 {
                                 ch=((unsigned char)*(s+i*dump_width+j)) & 0xff;
-                                sprintf(tmp,"%02x%c",ch,j==7?'-':' ');
-                                strcat(buf,tmp);
+                                BIO_snprintf(tmp,sizeof tmp,"%02x%c",ch,
+                                         j==7?'-':' ');
+                                BUF_strlcat(buf,tmp,sizeof buf);
                                 }
                         }
-                strcat(buf,"  ");
+                BUF_strlcat(buf,"  ",sizeof buf);
                 for(j=0;j<dump_width;j++)
                         {
                         if (((i*dump_width)+j)>=len)
                                 break;
                         ch=((unsigned char)*(s+i*dump_width+j)) & 0xff;
 #ifndef CHARSET_EBCDIC
-                        sprintf(tmp,"%c",((ch>=' ')&&(ch<='~'))?ch:'.');
+                        BIO_snprintf(tmp,sizeof tmp,"%c",
+                                 ((ch>=' ')&&(ch<='~'))?ch:'.');
 #else
-                        sprintf(tmp,"%c",((ch>=os_toascii[' '])&&(ch<=os_toascii['~']))
-                                ? os_toebcdic[ch]
-                                : '.');
+                        BIO_snprintf(tmp,sizeof tmp,"%c",
+                                 ((ch>=os_toascii[' '])&&(ch<=os_toascii['~']))
+                                 ? os_toebcdic[ch]
+                                 : '.');
 #endif
-                        strcat(buf,tmp);
+                        BUF_strlcat(buf,tmp,sizeof buf);
                         }
-                strcat(buf,"\n");
+                BUF_strlcat(buf,"\n",sizeof buf);
                 /* if this is the last call then update the ddt_dump thing so that
                  * we will move the selection point in the debug window 
                  */
@@ -144,7 +147,8 @@ int BIO_dump_indent(BIO *bio, const char *s, int len, int indent)
 #ifdef TRUNCATE
         if (trunc > 0)
                 {
-                sprintf(buf,"%s%04x - <SPACES/NULS>\n",str,len+trunc);
+                BIO_snprintf(buf,sizeof buf,"%s%04x - <SPACES/NULS>\n",str,
+                         len+trunc);
                 ret+=BIO_write(bio,(char *)buf,strlen(buf));
                 }
 #endif
diff --git a/src/lib/libcrypto/bio/b_print.c b/src/lib/libcrypto/bio/b_print.c
index 2cfc689dd6..fbff331796 100644
--- a/src/lib/libcrypto/bio/b_print.c
+++ b/src/lib/libcrypto/bio/b_print.c
@@ -576,12 +576,12 @@ abs_val(LDOUBLE value)
 }
 
 static LDOUBLE
-pow10(int exp)
+pow10(int in_exp)
 {
     LDOUBLE result = 1;
-    while (exp) {
+    while (in_exp) {
         result *= 10;
-        exp--;
+        in_exp--;
     }
     return result;
 }
@@ -652,8 +652,8 @@ fmtfp(
             (caps ? "0123456789ABCDEF"
               : "0123456789abcdef")[intpart % 10];
         intpart = (intpart / 10);
-    } while (intpart && (iplace < sizeof iplace));
-    if (iplace == sizeof iplace)
+    } while (intpart && (iplace < sizeof iconvert));
+    if (iplace == sizeof iconvert)
         iplace--;
     iconvert[iplace] = 0;
 
@@ -664,7 +664,7 @@ fmtfp(
               : "0123456789abcdef")[fracpart % 10];
         fracpart = (fracpart / 10);
     } while (fplace < max);
-    if (fplace == sizeof fplace)
+    if (fplace == sizeof fconvert)
         fplace--;
     fconvert[fplace] = 0;
 
diff --git a/src/lib/libcrypto/bio/b_sock.c b/src/lib/libcrypto/bio/b_sock.c
index 601a14f37c..c851298d1e 100644
--- a/src/lib/libcrypto/bio/b_sock.c
+++ b/src/lib/libcrypto/bio/b_sock.c
@@ -709,12 +709,12 @@ int BIO_accept(int sock, char **addr)
                         }
                 *addr=p;
                 }
-        sprintf(*addr,"%d.%d.%d.%d:%d",
-                (unsigned char)(l>>24L)&0xff,
-                (unsigned char)(l>>16L)&0xff,
-                (unsigned char)(l>> 8L)&0xff,
-                (unsigned char)(l     )&0xff,
-                port);
+        BIO_snprintf(*addr,24,"%d.%d.%d.%d:%d",
+                     (unsigned char)(l>>24L)&0xff,
+                     (unsigned char)(l>>16L)&0xff,
+                     (unsigned char)(l>> 8L)&0xff,
+                     (unsigned char)(l     )&0xff,
+                     port);
 end:
         return(ret);
         }
diff --git a/src/lib/libcrypto/bio/bio_cb.c b/src/lib/libcrypto/bio/bio_cb.c
index 0ffa4d2136..6f4254a114 100644
--- a/src/lib/libcrypto/bio/bio_cb.c
+++ b/src/lib/libcrypto/bio/bio_cb.c
@@ -70,55 +70,61 @@ long MS_CALLBACK BIO_debug_callback(BIO *bio, int cmd, const char *argp,
         MS_STATIC char buf[256];
         char *p;
         long r=1;
+        size_t p_maxlen;
 
         if (BIO_CB_RETURN & cmd)
                 r=ret;
 
-        sprintf(buf,"BIO[%08lX]:",(unsigned long)bio);
+        BIO_snprintf(buf,sizeof buf,"BIO[%08lX]:",(unsigned long)bio);
         p= &(buf[14]);
+        p_maxlen = sizeof buf - 14;
         switch (cmd)
                 {
         case BIO_CB_FREE:
-                sprintf(p,"Free - %s\n",bio->method->name);
+                BIO_snprintf(p,p_maxlen,"Free - %s\n",bio->method->name);
                 break;
         case BIO_CB_READ:
                 if (bio->method->type & BIO_TYPE_DESCRIPTOR)
-                        sprintf(p,"read(%d,%d) - %s fd=%d\n",bio->num,argi,bio->method->name,bio->num);
+                        BIO_snprintf(p,p_maxlen,"read(%d,%d) - %s fd=%d\n",
+                                 bio->num,argi,bio->method->name,bio->num);
                 else
-                        sprintf(p,"read(%d,%d) - %s\n",bio->num,argi,bio->method->name);
+                        BIO_snprintf(p,p_maxlen,"read(%d,%d) - %s\n",
+                                 bio->num,argi,bio->method->name);
                 break;
         case BIO_CB_WRITE:
                 if (bio->method->type & BIO_TYPE_DESCRIPTOR)
-                        sprintf(p,"write(%d,%d) - %s fd=%d\n",bio->num,argi,bio->method->name,bio->num);
+                        BIO_snprintf(p,p_maxlen,"write(%d,%d) - %s fd=%d\n",
+                                 bio->num,argi,bio->method->name,bio->num);
                 else
-                        sprintf(p,"write(%d,%d) - %s\n",bio->num,argi,bio->method->name);
+                        BIO_snprintf(p,p_maxlen,"write(%d,%d) - %s\n",
+                                 bio->num,argi,bio->method->name);
                 break;
         case BIO_CB_PUTS:
-                sprintf(p,"puts() - %s\n",bio->method->name);
+                BIO_snprintf(p,p_maxlen,"puts() - %s\n",bio->method->name);
                 break;
         case BIO_CB_GETS:
-                sprintf(p,"gets(%d) - %s\n",argi,bio->method->name);
+                BIO_snprintf(p,p_maxlen,"gets(%d) - %s\n",argi,bio->method->name);
                 break;
         case BIO_CB_CTRL:
-                sprintf(p,"ctrl(%d) - %s\n",argi,bio->method->name);
+                BIO_snprintf(p,p_maxlen,"ctrl(%d) - %s\n",argi,bio->method->name);
                 break;
         case BIO_CB_RETURN|BIO_CB_READ:
-                sprintf(p,"read return %ld\n",ret);
+                BIO_snprintf(p,p_maxlen,"read return %ld\n",ret);
                 break;
         case BIO_CB_RETURN|BIO_CB_WRITE:
-                sprintf(p,"write return %ld\n",ret);
+                BIO_snprintf(p,p_maxlen,"write return %ld\n",ret);
                 break;
         case BIO_CB_RETURN|BIO_CB_GETS:
-                sprintf(p,"gets return %ld\n",ret);
+                BIO_snprintf(p,p_maxlen,"gets return %ld\n",ret);
                 break;
         case BIO_CB_RETURN|BIO_CB_PUTS:
-                sprintf(p,"puts return %ld\n",ret);
+                BIO_snprintf(p,p_maxlen,"puts return %ld\n",ret);
                 break;
         case BIO_CB_RETURN|BIO_CB_CTRL:
-                sprintf(p,"ctrl return %ld\n",ret);
+                BIO_snprintf(p,p_maxlen,"ctrl return %ld\n",ret);
                 break;
         default:
-                sprintf(p,"bio callback - unknown type (%d)\n",cmd);
+                BIO_snprintf(p,p_maxlen,"bio callback - unknown type (%d)\n",cmd);
                 break;
                 }
 
diff --git a/src/lib/libcrypto/bio/bss_conn.c b/src/lib/libcrypto/bio/bss_conn.c
index 743db6ff94..f5d0e759e2 100644
--- a/src/lib/libcrypto/bio/bss_conn.c
+++ b/src/lib/libcrypto/bio/bss_conn.c
@@ -521,8 +521,8 @@ static long conn_ctrl(BIO *b, int cmd, long num, void *ptr)
                                 char buf[16];
                                 unsigned char *p = ptr;
 
-                                sprintf(buf,"%d.%d.%d.%d",
-                                        p[0],p[1],p[2],p[3]);
+                                BIO_snprintf(buf,sizeof buf,"%d.%d.%d.%d",
+                                             p[0],p[1],p[2],p[3]);
                                 if (data->param_hostname != NULL)
                                         OPENSSL_free(data->param_hostname);
                                 data->param_hostname=BUF_strdup(buf);
@@ -532,7 +532,7 @@ static long conn_ctrl(BIO *b, int cmd, long num, void *ptr)
                                 {
                                 char buf[DECIMAL_SIZE(int)+1];
 
-                                sprintf(buf,"%d",*(int *)ptr);
+                                BIO_snprintf(buf,sizeof buf,"%d",*(int *)ptr);
                                 if (data->param_port != NULL)
                                         OPENSSL_free(data->param_port);
                                 data->param_port=BUF_strdup(buf);
diff --git a/src/lib/libcrypto/bio/bss_file.c b/src/lib/libcrypto/bio/bss_file.c
index 6904b5c081..9cdf159f82 100644
--- a/src/lib/libcrypto/bio/bss_file.c
+++ b/src/lib/libcrypto/bio/bss_file.c
@@ -249,15 +249,15 @@ static long MS_CALLBACK file_ctrl(BIO *b, int cmd, long num, void *ptr)
                 if (num & BIO_FP_APPEND)
                         {
                         if (num & BIO_FP_READ)
-                                strcpy(p,"a+");
-                        else    strcpy(p,"a");
+                                BUF_strlcpy(p,"a+",sizeof p);
+                        else    BUF_strlcpy(p,"a",sizeof p);
                         }
                 else if ((num & BIO_FP_READ) && (num & BIO_FP_WRITE))
-                        strcpy(p,"r+");
+                        BUF_strlcpy(p,"r+",sizeof p);
                 else if (num & BIO_FP_WRITE)
-                        strcpy(p,"w");
+                        BUF_strlcpy(p,"w",sizeof p);
                 else if (num & BIO_FP_READ)
-                        strcpy(p,"r");
+                        BUF_strlcpy(p,"r",sizeof p);
                 else
                         {
                         BIOerr(BIO_F_FILE_CTRL,BIO_R_BAD_FOPEN_MODE);