1 files changed, 17 insertions, 24 deletions

diff --git a/src/lib/libcrypto/mem_dbg.c b/src/lib/libcrypto/mem_dbg.c
index 57bd08f65d..ea94eee6f4 100644
--- a/src/lib/libcrypto/mem_dbg.c
+++ b/src/lib/libcrypto/mem_dbg.c
@@ -102,8 +102,6 @@ typedef struct app_mem_info_st
         int references;
         } APP_INFO;
 
-static void app_info_free(APP_INFO *);
-
 static LHASH *amih=NULL; /* hash-table with those app_mem_info_st's
                           * that are at the top of their thread's stack
                           * (with `thread' as key);
@@ -142,18 +140,6 @@ static unsigned long disabling_thread = 0; /* Valid iff num_disable > 0.
                                             * thread named in disabling_thread).
                                             */
 
-static void app_info_free(APP_INFO *inf)
-        {
-        if (--(inf->references) <= 0)
-                {
-                if (inf->next != NULL)
-                        {
-                        app_info_free(inf->next);
-                        }
-                OPENSSL_free(inf);
-                }
-        }
-
 int CRYPTO_mem_ctrl(int mode)
         {
         int ret=mh_mode;
@@ -516,7 +502,9 @@ void CRYPTO_dbg_free(void *addr, int before_p)
                                 mp->order, mp->addr, mp->num);
 #endif
                                 if (mp->app_info != NULL)
-                                        app_info_free(mp->app_info);
+                                        {
+                                        mp->app_info->references--;
+                                        }
                                 OPENSSL_free(mp);
                                 }
 
@@ -597,6 +585,8 @@ static void print_leak(const MEM *m, MEM_LEAK *l)
         struct tm *lcl = NULL;
         unsigned long ti;
 
+#define BUF_REMAIN (sizeof buf - (size_t)(bufp - buf))
+
         if(m->addr == (char *)l->bio)
             return;
 
@@ -604,22 +594,22 @@ static void print_leak(const MEM *m, MEM_LEAK *l)
                 {
                 lcl = localtime(&m->time);
         
-                sprintf(bufp, "[%02d:%02d:%02d] ",
+                snprintf(bufp, BUF_REMAIN, "[%02d:%02d:%02d] ",
                         lcl->tm_hour,lcl->tm_min,lcl->tm_sec);
                 bufp += strlen(bufp);
                 }
 
-        sprintf(bufp, "%5lu file=%s, line=%d, ",
+        snprintf(bufp, BUF_REMAIN, "%5lu file=%s, line=%d, ",
                 m->order,m->file,m->line);
         bufp += strlen(bufp);
 
         if (options & V_CRYPTO_MDEBUG_THREAD)
                 {
-                sprintf(bufp, "thread=%lu, ", m->thread);
+                snprintf(bufp, BUF_REMAIN, "thread=%lu, ", m->thread);
                 bufp += strlen(bufp);
                 }
 
-        sprintf(bufp, "number=%d, address=%08lX\n",
+        snprintf(bufp, BUF_REMAIN, "number=%d, address=%08lX\n",
                 m->num,(unsigned long)m->addr);
         bufp += strlen(bufp);
 
@@ -641,7 +631,7 @@ static void print_leak(const MEM *m, MEM_LEAK *l)
 
                 ami_cnt++;
                 memset(buf,'>',ami_cnt);
-                sprintf(buf + ami_cnt,
+                snprintf(buf + ami_cnt, sizeof buf - ami_cnt,
                         " thread=%lu, file=%s, line=%d, info=\"",
                         amip->thread, amip->file, amip->line);
                 buf_len=strlen(buf);
@@ -653,10 +643,11 @@ static void print_leak(const MEM *m, MEM_LEAK *l)
                         }
                 else
                         {
-                        strcpy(buf + buf_len, amip->info);
+                        strlcpy(buf + buf_len, amip->info,
+                                sizeof buf - buf_len);
                         buf_len = strlen(buf);
                         }
-                sprintf(buf + buf_len, "\"\n");
+                snprintf(buf + buf_len, sizeof buf - buf_len, "\"\n");
                 
                 BIO_puts(l->bio,buf);
 
@@ -678,6 +669,7 @@ static IMPLEMENT_LHASH_DOALL_ARG_FN(print_leak, const MEM *, MEM_LEAK *)
 void CRYPTO_mem_leaks(BIO *b)
         {
         MEM_LEAK ml;
+        char buf[80];
 
         if (mh == NULL && amih == NULL)
                 return;
@@ -692,8 +684,9 @@ void CRYPTO_mem_leaks(BIO *b)
                                 (char *)&ml);
         if (ml.chunks != 0)
                 {
-                BIO_printf(b,"%ld bytes leaked in %d chunks\n",
-                           ml.bytes,ml.chunks);
+                snprintf(buf,sizeof buf,"%ld bytes leaked in %d chunks\n",
+                        ml.bytes,ml.chunks);
+                BIO_puts(b,buf);
                 }
         else
                 {