Replace sprintf with erts_snprintf in beam

15 files changed, 46 insertions, 41 deletions

diff --git a/erts/emulator/beam/bif.c b/erts/emulator/beam/bif.c
index 66f4259d20..1cdce49eef 100644
--- a/erts/emulator/beam/bif.c
+++ b/erts/emulator/beam/bif.c
@@ -2844,7 +2844,7 @@ BIF_RETTYPE float_to_list_1(BIF_ALIST_1)
      if (is_not_float(BIF_ARG_1))
 	 BIF_ERROR(BIF_P, BADARG);
      GET_DOUBLE(BIF_ARG_1, f);
-     if ((i = sys_double_to_chars(f.fd, fbuf)) <= 0)
+     if ((i = sys_double_to_chars(f.fd, fbuf, sizeof(fbuf))) <= 0)
 	 BIF_ERROR(BIF_P, EXC_INTERNAL_ERROR);
      need = i*2;
      hp = HAlloc(BIF_P, need);
diff --git a/erts/emulator/beam/erl_alloc.c b/erts/emulator/beam/erl_alloc.c
index ba73ca6da7..3eee53eba3 100644
--- a/erts/emulator/beam/erl_alloc.c
+++ b/erts/emulator/beam/erl_alloc.c
@@ -1675,7 +1675,7 @@ erts_alc_fatal_error(int error, int func, ErtsAlcType_t n, ...)
 
     t_str = type_no_str(n);
     if (!t_str) {
-	sprintf(buf, "%d", (int) n);
+	erts_snprintf(buf, sizeof(buf), "%d", (int) n);
 	t_str = buf;
     }
 
@@ -3572,12 +3572,12 @@ check_memory_fence(void *ptr, Uint *size, ErtsAlcType_t n, int func)
 
 	ftype = type_no_str(found_type);
 	if (!ftype) {
-	    sprintf(fbuf, "%d", (int) found_type);
+	    erts_snprintf(fbuf, sizeof(fbuf), "%d", (int) found_type);
 	    ftype = fbuf;
 	}
 	otype = type_no_str(n);
 	if (!otype) {
-	    sprintf(obuf, "%d", (int) n);
+	    erts_snprintf(obuf, sizeof(obuf), "%d", (int) n);
 	    otype = obuf;
 	}
 
diff --git a/erts/emulator/beam/erl_bif_os.c b/erts/emulator/beam/erl_bif_os.c
index 831e05493a..1062d4379b 100644
--- a/erts/emulator/beam/erl_bif_os.c
+++ b/erts/emulator/beam/erl_bif_os.c
@@ -58,7 +58,7 @@ BIF_RETTYPE os_getpid_0(BIF_ALIST_0)
      char pid_string[21]; /* enough for a 64 bit number */
      int n;
      Eterm* hp;
-     sys_get_pid(pid_string); /* In sys.c */
+     sys_get_pid(pid_string, sizeof(pid_string)); /* In sys.c */
      n = sys_strlen(pid_string);
      hp = HAlloc(BIF_P, n*2);
      BIF_RET(buf_to_intlist(&hp, pid_string, n, NIL));
diff --git a/erts/emulator/beam/erl_db_util.c b/erts/emulator/beam/erl_db_util.c
index 42907e2e84..0c9ca83ce4 100644
--- a/erts/emulator/beam/erl_db_util.c
+++ b/erts/emulator/beam/erl_db_util.c
@@ -2480,7 +2480,7 @@ Eterm db_format_dmc_err_info(Process *p, DMCErrInfo *ei)
 	    vnum = tmp->variable;
 	}
 	if (vnum >= 0)
-	    sprintf(buff,tmp->error_string, vnum);
+	    erts_snprintf(buff,sizeof(buff)+20,tmp->error_string, vnum);
 	else
 	    strcpy(buff,tmp->error_string);
 	sl = strlen(buff);
@@ -4485,7 +4485,9 @@ static DMCRet dmc_fun(DMCContext *context,
 	if (context->err_info != NULL) {
 	    /* Ugly, should define a better RETURN_TERM_ERROR interface... */
 	    char buff[100];
-	    sprintf(buff, "Function %%T/%d does_not_exist.", (int)a - 1);
+	    erts_snprintf(buff, sizeof(buff),
+		    "Function %%T/%d does_not_exist.",
+		    (int)a - 1);
 	    RETURN_TERM_ERROR(buff, p[1], context, *constant);
 	} else {
 	    return retFail;
@@ -4500,7 +4502,7 @@ static DMCRet dmc_fun(DMCContext *context,
 	if (context->err_info != NULL) {
 	    /* Ugly, should define a better RETURN_TERM_ERROR interface... */
 	    char buff[100];
-	    sprintf(buff, 
+	    erts_snprintf(buff, sizeof(buff),
 		    "Function %%T/%d cannot be called in this context.",
 		    (int)a - 1);
 	    RETURN_TERM_ERROR(buff, p[1], context, *constant);
@@ -4764,7 +4766,7 @@ static int match_compact(ErlHeapFragment *expr, DMCErrInfo *err_info)
 	    for (j = 0; j < x && DMC_PEEK(heap,j) != n; ++j) 
 		;
 	    ASSERT(j < x);
-	    sprintf(buff+1,"%u", (unsigned) j);
+	    erts_snprintf(buff+1, sizeof(buff) - 1, "%u", (unsigned) j);
 	    /* Yes, writing directly into terms, they ARE off heap */
 	    *p = am_atom_put(buff, strlen(buff));
 	}
diff --git a/erts/emulator/beam/erl_mtrace.c b/erts/emulator/beam/erl_mtrace.c
index 358c67bf20..5a6fb8589f 100644
--- a/erts/emulator/beam/erl_mtrace.c
+++ b/erts/emulator/beam/erl_mtrace.c
@@ -611,7 +611,7 @@ void erts_mtrace_init(char *receiver, char *nodename)
 	if (erts_sock_gethostname(hostname, MAXHOSTNAMELEN) != 0)
 	    hostname[0] = '\0';
 	hostname[MAXHOSTNAMELEN-1] = '\0';
-	sys_get_pid(pid);
+	sys_get_pid(pid, sizeof(pid));
 	write_trace_header(nodename ? nodename : "", pid, hostname);
 	erts_mtrace_update_heap_size();
     }
diff --git a/erts/emulator/beam/erl_process.c b/erts/emulator/beam/erl_process.c
index c58bf40435..ddc43e621d 100644
--- a/erts/emulator/beam/erl_process.c
+++ b/erts/emulator/beam/erl_process.c
@@ -9453,7 +9453,7 @@ stack_element_dump(int to, void *to_arg, Process* p, Eterm* sp, int yreg)
         erts_print(to, to_arg, "\n%p ", sp);
     } else {
         char sbuf[16];
-        sprintf(sbuf, "y(%d)", yreg);
+        erts_snprintf(sbuf, sizeof(sbuf), "y(%d)", yreg);
         erts_print(to, to_arg, "%-8s ", sbuf);
         yreg++;
     }
diff --git a/erts/emulator/beam/erl_process_dump.c b/erts/emulator/beam/erl_process_dump.c
index 964dc1ae3e..542c5ed0d9 100644
--- a/erts/emulator/beam/erl_process_dump.c
+++ b/erts/emulator/beam/erl_process_dump.c
@@ -323,7 +323,7 @@ heap_dump(int to, void *to_arg, Eterm x)
 		    int i;
 
 		    GET_DOUBLE_DATA((ptr+1), f);
-		    i = sys_double_to_chars(f.fd, (char*) sbuf);
+		    i = sys_double_to_chars(f.fd, (char*) sbuf, sizeof(sbuf));
 		    sys_memset(sbuf+i, 0, 31-i);
 		    erts_print(to, to_arg, "F%X:%s\n", i, sbuf);
 		    *ptr = OUR_NIL;
diff --git a/erts/emulator/beam/erl_term.c b/erts/emulator/beam/erl_term.c
index f77e8b798f..bf7774f882 100644
--- a/erts/emulator/beam/erl_term.c
+++ b/erts/emulator/beam/erl_term.c
@@ -105,7 +105,7 @@ unsigned tag_val_def(Wterm x)
 	  break;
       }
     }
-    sprintf(msg, "tag_val_def: %#lx", (unsigned long) x);
+    erts_snprintf(msg, sizeof(msg), "tag_val_def: %#lx", (unsigned long) x);
     et_abort(msg, file, line);
 #undef file
 #undef line
diff --git a/erts/emulator/beam/external.c b/erts/emulator/beam/external.c
index 16a987472a..ab1065aaa1 100644
--- a/erts/emulator/beam/external.c
+++ b/erts/emulator/beam/external.c
@@ -1850,8 +1850,8 @@ enc_term(ErtsAtomCacheMap *acmp, Eterm obj, byte* ep, Uint32 dflags,
 	    } else {
 		*ep++ = FLOAT_EXT;
 
-		/* now the sprintf which does the work */
-		i = sys_double_to_chars(f.fd, (char*) ep);
+		/* now the erts_snprintf which does the work */
+		i = sys_double_to_chars(f.fd, (char*) ep, (size_t)31);
 
 		/* Don't leave garbage after the float!  (Bad practice in general,
 		 * and Purify complains.)
diff --git a/erts/emulator/beam/sys.h b/erts/emulator/beam/sys.h
index 2c65ce91d1..0e6bec352e 100644
--- a/erts/emulator/beam/sys.h
+++ b/erts/emulator/beam/sys.h
@@ -691,8 +691,8 @@ void fini_getenv_state(GETENV_STATE *);
 /* xxxP */
 void init_sys_float(void);
 int sys_chars_to_double(char*, double*);
-int sys_double_to_chars(double, char*);
-void sys_get_pid(char *);
+int sys_double_to_chars(double, char*, size_t);
+void sys_get_pid(char *, size_t);
 
 /* erts_sys_putenv() returns, 0 on success and a value != 0 on failure. */
 int erts_sys_putenv(char *key, char *value);
diff --git a/erts/emulator/drivers/win32/registry_drv.c b/erts/emulator/drivers/win32/registry_drv.c
index 1fad34e380..5b200ebd32 100644
--- a/erts/emulator/drivers/win32/registry_drv.c
+++ b/erts/emulator/drivers/win32/registry_drv.c
@@ -344,7 +344,7 @@ fix_value_result(RegPort* rp, LONG result, DWORD type,
 #ifdef DEBUG
 	if (ok != ERROR_SUCCESS) {
 	    char buff[256];
-	    sprintf(buff,"Failure in registry_drv line %d, error = %d",
+	    erts_snprintf(buff, sizeof(buff), "Failure in registry_drv line %d, error = %d",
 		    __LINE__, GetLastError());
 	    MessageBox(NULL, buff, "Internal error", MB_OK);
 	    ASSERT(ok == ERROR_SUCCESS);
diff --git a/erts/emulator/sys/unix/sys.c b/erts/emulator/sys/unix/sys.c
index c1fa00b4ea..97756e8434 100644
--- a/erts/emulator/sys/unix/sys.c
+++ b/erts/emulator/sys/unix/sys.c
@@ -570,7 +570,7 @@ erl_sys_init(void)
 		   + 1);
     child_setup_prog = erts_alloc(ERTS_ALC_T_CS_PROG_PATH, csp_path_sz);
     erts_smp_atomic_add_nob(&sys_misc_mem_sz, csp_path_sz);
-    sprintf(child_setup_prog,
+    erts_snprintf(child_setup_prog, csp_path_sz,
             "%s%c%s",
             bindir,
             DIR_SEPARATOR_CHAR,
@@ -1532,12 +1532,13 @@ static ErlDrvData spawn_start(ErlDrvPort port_num, char* name, SysDriverOpts* op
 	}
 #if !DISABLE_VFORK
     }
+#define ENOUGH_BYTES (44)
     else { /* Use vfork() */
 	char **cs_argv= erts_alloc(ERTS_ALC_T_TMP,(CS_ARGV_NO_OF_ARGS + 1)*
 				   sizeof(char *));
-	char fd_close_range[44];                  /* 44 bytes are enough to  */
-	char dup2_op[CS_ARGV_NO_OF_DUP2_OPS][44]; /* hold any "%d:%d" string */
-                                                  /* on a 64-bit machine.    */
+	char fd_close_range[ENOUGH_BYTES];                  /* 44 bytes are enough to  */
+	char dup2_op[CS_ARGV_NO_OF_DUP2_OPS][ENOUGH_BYTES]; /* hold any "%d:%d" string */
+                                                            /* on a 64-bit machine.    */
 
 	/* Setup argv[] for the child setup program (implemented in
 	   erl_child_setup.c) */
@@ -1545,23 +1546,23 @@ static ErlDrvData spawn_start(ErlDrvPort port_num, char* name, SysDriverOpts* op
 	if (opts->use_stdio) {
 	    if (opts->read_write & DO_READ){
 		/* stdout for process */
-		sprintf(&dup2_op[i++][0], "%d:%d", ifd[1], 1);
+		erts_snprintf(&dup2_op[i++][0], ENOUGH_BYTES, "%d:%d", ifd[1], 1);
 		if(opts->redir_stderr)
 		    /* stderr for process */
-		    sprintf(&dup2_op[i++][0], "%d:%d", ifd[1], 2);
+		    erts_snprintf(&dup2_op[i++][0], ENOUGH_BYTES, "%d:%d", ifd[1], 2);
 	    }
 	    if (opts->read_write & DO_WRITE)
 		/* stdin for process */
-		sprintf(&dup2_op[i++][0], "%d:%d", ofd[0], 0);
+		erts_snprintf(&dup2_op[i++][0], ENOUGH_BYTES, "%d:%d", ofd[0], 0);
 	} else {	/* XXX will fail if ofd[0] == 4 (unlikely..) */
 	    if (opts->read_write & DO_READ)
-		sprintf(&dup2_op[i++][0], "%d:%d", ifd[1], 4);
+		erts_snprintf(&dup2_op[i++][0], ENOUGH_BYTES, "%d:%d", ifd[1], 4);
 	    if (opts->read_write & DO_WRITE)
-		sprintf(&dup2_op[i++][0], "%d:%d", ofd[0], 3);
+		erts_snprintf(&dup2_op[i++][0], ENOUGH_BYTES, "%d:%d", ofd[0], 3);
 	}
 	for (; i < CS_ARGV_NO_OF_DUP2_OPS; i++)
 	    strcpy(&dup2_op[i][0], "-");
-	sprintf(fd_close_range, "%d:%d", opts->use_stdio ? 3 : 5, max_files-1);
+	erts_snprintf(fd_close_range, ENOUGH_BYTES, "%d:%d", opts->use_stdio ? 3 : 5, max_files-1);
 
 	cs_argv[CS_ARGV_PROGNAME_IX] = child_setup_prog;
 	cs_argv[CS_ARGV_WD_IX] = opts->wd ? opts->wd : ".";
@@ -1612,6 +1613,7 @@ static ErlDrvData spawn_start(ErlDrvPort port_num, char* name, SysDriverOpts* op
 	}
 	erts_free(ERTS_ALC_T_TMP,cs_argv);
     }
+#undef ENOUGH_BYTES
 #endif
 
     erts_sched_bind_atfork_parent(unbind);
@@ -2355,10 +2357,10 @@ void erts_do_break_handling(void)
 ** no interpretatione of this should be done by the rest of the
 ** emulator. The buffer should be at least 21 bytes long.
 */
-void sys_get_pid(char *buffer){
+void sys_get_pid(char *buffer, size_t buffer_size){
     pid_t p = getpid();
     /* Assume the pid is scalar and can rest in an unsigned long... */
-    sprintf(buffer,"%lu",(unsigned long) p);
+    erts_snprintf(buffer, buffer_size, "%lu",(unsigned long) p);
 }
 
 int
diff --git a/erts/emulator/sys/unix/sys_float.c b/erts/emulator/sys/unix/sys_float.c
index 8ec7b31ce0..3fcb4d88dc 100644
--- a/erts/emulator/sys/unix/sys_float.c
+++ b/erts/emulator/sys/unix/sys_float.c
@@ -745,18 +745,18 @@ void erts_sys_unblock_fpe(int unmasked)
  */
 
 int
-sys_double_to_chars(double fp, char *buf)
+sys_double_to_chars(double fp, char *buffer, size_t buffer_size)
 {
-    char *s = buf;
+    char *s = buffer;
     
-    (void) sprintf(buf, "%.20e", fp);
+    (void) erts_snprintf(buffer, buffer_size, "%.20e", fp);
     /* Search upto decimal point */
     if (*s == '+' || *s == '-') s++;
     while (ISDIGIT(*s)) s++;
     if (*s == ',') *s++ = '.'; /* Replace ',' with '.' */
     /* Scan to end of string */
     while (*s) s++;
-    return s-buf; /* i.e strlen(buf) */
+    return s-buffer; /* i.e strlen(buffer) */
 }
 
 /* Float conversion */
diff --git a/erts/emulator/sys/win32/sys.c b/erts/emulator/sys/win32/sys.c
index 6894d682e7..1c9f8ebf43 100755
--- a/erts/emulator/sys/win32/sys.c
+++ b/erts/emulator/sys/win32/sys.c
@@ -2764,10 +2764,10 @@ static void stop_select(ErlDrvEvent e, void* _)
 ** no interpretation of this should be done by the rest of the
 ** emulator. The buffer should be at least 21 bytes long.
 */
-void sys_get_pid(char *buffer){
+void sys_get_pid(char *buffer, size_t buffer_size){
     DWORD p = GetCurrentProcessId();
     /* The pid is scalar and is an unsigned long. */
-    sprintf(buffer,"%lu",(unsigned long) p);
+    erts_snprintf(buffer, buffer_size, "%lu",(unsigned long) p);
 }
 
 void
@@ -3107,7 +3107,8 @@ erl_assert_error(char* expr, char* file, int line)
 {   
     char message[1024];
 
-    sprintf(message, "File %hs, line %d: %hs", file, line, expr);
+    erts_snprintf(message, sizeof(message),
+	    "File %hs, line %d: %hs", file, line, expr);
     MessageBox(GetActiveWindow(), message, "Assertion failed",
 	       MB_OK | MB_ICONERROR);
 #if 0
diff --git a/erts/emulator/sys/win32/sys_float.c b/erts/emulator/sys/win32/sys_float.c
index 6558ad2d99..09dad89140 100644
--- a/erts/emulator/sys/win32/sys_float.c
+++ b/erts/emulator/sys/win32/sys_float.c
@@ -118,18 +118,18 @@ sys_chars_to_double(char *buf, double *fp)
 */
 
 int
-sys_double_to_chars(double fp, char *buf)
+sys_double_to_chars(double fp, char *buffer, size_t buffer_size)
 {
-    char *s = buf;
+    char *s = buffer;
     
-    (void) sprintf(buf, "%.20e", fp);
+    (void) erts_snprintf(buffer, buffer_size, "%.20e", fp);
     /* Search upto decimal point */
     if (*s == '+' || *s == '-') s++;
     while (isdigit(*s)) s++;
     if (*s == ',') *s++ = '.'; /* Replace ',' with '.' */
     /* Scan to end of string */
     while (*s) s++;
-    return s-buf; /* i.e strlen(buf) */
+    return s-buffer; /* i.e strlen(buffer) */
 }
 
 int