[mapserver-commits] r10458 - trunk/mapserver

[svn at osgeo.org]

Author: dmorissette
Date: 2010-08-17 15:39:29 +0000 (Tue, 17 Aug 2010)
New Revision: 10458

Modified:
   trunk/mapserver/maputil.c
Log:
Use snprintf() instead of sprintf(). (Related to #3484)

Modified: trunk/mapserver/maputil.c
===================================================================
--- trunk/mapserver/maputil.c	2010-08-14 16:41:44 UTC (rev 10457)
+++ trunk/mapserver/maputil.c	2010-08-17 15:39:29 UTC (rev 10458)
@@ -1351,6 +1351,7 @@
     const char *fullFname;
     char tmpId[128]; /* big enough for time + pid + ext */
     const char *tmpBase = NULL;
+    int tmpFnameBufsize;
 
     if( ForcedTmpBase != NULL )
     {
@@ -1359,15 +1360,16 @@
     else 
     {
         /* We'll use tmpId and tmpCount to generate unique filenames */
-        sprintf(tmpId, "%lx_%x",(long)time(NULL),(int)getpid());
+        snprintf(tmpId, sizeof(tmpId), "%lx_%x",(long)time(NULL),(int)getpid());
         tmpBase = tmpId;
     }
 
     if (ext == NULL)  ext = "";
-    tmpFname = (char*)malloc(strlen(tmpBase) + 10  + strlen(ext) + 1);
+    tmpFnameBufsize = strlen(tmpBase) + 10  + strlen(ext) + 1;
+    tmpFname = (char*)malloc(tmpFnameBufsize);
 
     msAcquireLock( TLOCK_TMPFILE );
-    sprintf(tmpFname, "%s_%x.%s", tmpBase, tmpCount++, ext);
+    snprintf(tmpFname, tmpFnameBufsize, "%s_%x.%s", tmpBase, tmpCount++, ext);
     msReleaseLock( TLOCK_TMPFILE );
 
     fullFname = msBuildPath3(szPath, mappath, tmppath, tmpFname);