[FIX] prevent issues 04/29104/3
authorVitaliy Cherepanov <v.cherepanov@samsung.com>
Tue, 21 Oct 2014 11:39:20 +0000 (15:39 +0400)
committerVitaliy Andreevich <v.cherepanov@samsung.com>
Tue, 21 Oct 2014 12:08:23 +0000 (05:08 -0700)
|-------------------------|----------------------------|
| Type                    | Function                   |
|-------------------------|----------------------------|
| Out-of-bounds read      | kh_resize_allocmap         |
| Out-of-bounds read      | kh_resize_symbol           |
| Out-of-bounds read      | kh_resize_object           |
| Out-of-bounds read      | kh_resize_uiobject         |
| Out-of-bounds read      | kh_resize_detector         |
| Calling risky function  | remove_indir               |
| Calling risky function  | _init_probe                |
| Calling risky function  | _configure                 |
| Calling risky function  | createSocket               |
| Calling risky function  | _init_                     |
| Calling risky function  | _uninit_                   |
| Calling risky function  | add_to_glist               |
| Calling risky function  | pack_string_to_file        |
| Calling risky function  | pack_value_by_type         |
| Calling risky function  | pack_string_to_file        |
| Calling risky function  | pack_value_by_type         |
| Calling risky function  | profil_backtrace_symbols   |
| Calling risky function  | _fini_probe                |
| Calling risky function  | getBacktraceString         |
| Calling risky function  | recvThread                 |
| Calling risky function  | captureScreen              |
| Calling risky function  | real_abs_path              |
| Calling risky function  | da_set_callback            |
| Resource leak           | set_real_func              |
| Calling risky function  | probe_terminate_with_err   |
| Calling risky function  | __local_glVertexAttrib1f   |
| Calling risky function  | __local_glVertexAttrib1fv  |
| Calling risky function  | __local_glVertexAttrib2f   |
| Calling risky function  | __local_glVertexAttrib2fv  |
| Calling risky function  | __local_glVertexAttrib3f   |
| Calling risky function  | __local_glVertexAttrib3fv  |
| Calling risky function  | __local_glVertexAttrib4f   |
| Calling risky function  | __local_glVertexAttrib4fv  |
| Calling risky function  | __local_glLinkProgram      |
| Calling risky function  | __local_glTexParameterfv   |
| Calling risky function  | __local_glTexParameteriv   |
| Calling risky function  | glTexParameterfv           |
| Calling risky function  | glTexParameteriv           |
| Calling risky function  | glVertexAttrib1f           |
| Calling risky function  | glVertexAttrib2f           |
| Calling risky function  | glVertexAttrib3f           |
| Calling risky function  | glVertexAttrib4f           |
| Calling risky function  | glVertexAttrib1fv          |
| Calling risky function  | glVertexAttrib2fv          |
| Calling risky function  | glVertexAttrib3fv          |
| Calling risky function  | glVertexAttrib4fv          |
| Calling risky function  | __ui_array_to_str          |
| Calling risky function  | glLinkProgram              |
| Calling risky function  | init_probe_gl              |
|-------------------------|----------------------------|

Change-Id: I17ec1304600da2e28553681c8ee26cbf1bfe3024
Signed-off-by: Vitaliy Cherepanov <v.cherepanov@samsung.com>
custom_chart/da_chart.c
helper/common_probe_init.c
helper/dacapture.c
helper/dacollection.c
helper/dahelper.c
helper/libdaprobe.c
include/binproto.h
include/dahelper.h
probe_graphics/da_gles20_native.cpp
probe_userfunc/libdauserfunc.c

index 801e0fc6f9dcccd7d9310f382a77b57aa6254434..5dc255ded8753eb417797a5bc15cf5ae248214ee 100755 (executable)
@@ -559,7 +559,7 @@ int da_set_callback(da_handle series_handle, da_user_data_2_chart_data callback,
                int re;
                add_to_callback_list(interval, cindex, series_handle, callback, data_addr);
                re = start_callback_thread(interval);
-               LOG("start callback thread return %d\n", re);
+               PRINTMSG("start callback thread return %d\n", re);
        }
        probeBlockEnd();
 
index 59c1c18b232dd9caae2a18f5fa5d5b0a91edf1da..db1f433b363673972d7d0e650091887e892dc315 100644 (file)
@@ -57,7 +57,11 @@ void set_real_func(const char *func_name, void **func_pointer,
        void *faddr;
        void *_id;
 
-       _id = dlopen(lib_string[id], RTLD_LAZY);
+       if (lib_handle[id] == NULL)
+               lib_handle[id] = dlopen(lib_string[id], RTLD_LAZY);
+
+       _id = lib_handle[id];
+
        if (_id == NULL)
                probe_terminate_with_err("dlopen failed", func_name, id);
 
@@ -101,7 +105,8 @@ void probe_terminate_with_err(const char *msg, const char *func_name,
 
        if (id != LIB_NO && id < NUM_ORIGINAL_LIBRARY)
                lib_name = lib_string[id];
-       sprintf(error_msg, "%s : [%s], %s\n", msg, func_name, lib_name);
+       snprintf(error_msg, sizeof(error_msg), "%s : [%s], %s\n", msg,
+                func_name, lib_name);
        perror(error_msg);
        PRINTERR(error_msg);
        //wait for flush
@@ -174,7 +179,7 @@ void init_probe_gl(const char *func_name, void **func_pointer,
                        real_glGetIntegerv(GL_MAX_VERTEX_ATTRIBS, &maxVal[0]);
                        real_glGetIntegerv(GL_MAX_COMBINED_TEXTURE_IMAGE_UNITS,
                                           &maxVal[1]);
-                       sprintf(maxValString, "%d,%d", maxVal[0], maxVal[1]);
+                       snprintf(maxValString, sizeof(maxValString), "%d,%d", maxVal[0], maxVal[1]);
                        PREPARE_LOCAL_BUF();
                        PACK_COMMON_BEGIN(MSG_PROBE_GL, vAPI_ID, "", 0);
                        PACK_COMMON_END('p', 1, 0, 0);
index 516014b3a475dc19cacadd2dad3a7e9b3683802e..d6cd076354826476e475fb0b3b059799aebc58aa 100755 (executable)
@@ -311,7 +311,7 @@ static void destroy_canvas(Evas* canvas)
 
 int captureScreen()
 {
-       char dstpath[32];
+       char dstpath[MAX_PATH_LENGTH];
        char* scrimage;
        int width, height;
        Evas* ev = NULL;
@@ -333,7 +333,9 @@ int captureScreen()
                ev = create_canvas(width, height);
                if(likely(ev != NULL))
                {
-                       sprintf(dstpath, SCREENSHOT_DIRECTORY "/%d_%d.png", getpid(), probeInfo.eventIndex);
+                       snprintf(dstpath, sizeof(dstpath),
+                                SCREENSHOT_DIRECTORY "/%d_%d.png", getpid(),
+                                probeInfo.eventIndex);
 
                        // make image buffer
                        if((img = evas_object_image_add(ev)) != NULL)
index b807238864ae90c45f0ca6be456e92d6ff5fc4ac..efff25636ac5e82a669f7e1ff24fa570aef34a08 100755 (executable)
@@ -755,7 +755,7 @@ int add_to_glist(char* key, void* data)
                        elm->keystr = (char*)real_malloc(elm->keylen + 1);
                        if (likely(elm->keystr != NULL))
                        {
-                               strcpy(elm->keystr, key);
+                               memcpy(elm->keystr, key, elm->keylen + 1);
                                elm->dataptr = data;
                                elm->next = gsymbol_list;
                                elm->prev = NULL;
index a5916f6728860f0661bc97b5c4c32dee0afa4959..6ce75e533bd9d178d5c6554dd6abd79f9bfa389c 100755 (executable)
@@ -92,6 +92,9 @@ int remove_indir(const char *dirname)
        DIR *dir;
        struct dirent *entry;
        char path[MAX_PATH_LENGTH];
+       static char dirent_buffer[ sizeof(struct dirent) + PATH_MAX + 1 ] = {0,};
+       static struct dirent *dirent_r = (struct dirent *)dirent_buffer;
+
 
        dir = opendir(dirname);
        if(dir == NULL)
@@ -99,8 +102,7 @@ int remove_indir(const char *dirname)
                return -1;
        }
 
-       while((entry = readdir(dir)) != NULL)
-       {
+       while ((readdir_r(dir, dirent_r, &entry) == 0) && entry) {
                if (strcmp(entry->d_name, ".") && strcmp(entry->d_name, ".."))
                {
                        snprintf(path, (size_t) MAX_PATH_LENGTH, "%s/%s", dirname, entry->d_name);
@@ -142,7 +144,7 @@ char *real_abs_path(int fd, char *buffer, size_t bufsiz)
        if (fd < 0)
                return NULL;
 
-       sprintf(proc_path, PROC_FD, fd);
+       snprintf(proc_path, sizeof(proc_path), PROC_FD, fd);
 
        ret = readlink(proc_path, buffer, bufsiz);
        if (ret < 0) /* some error occured */
index 87f0317d82e861fae0ac3aff3df4ebcec7b4a214..97b1f2ebee4f9ef5a4b82a265913e9c786168057 100755 (executable)
@@ -91,15 +91,13 @@ void *(*real_malloc)(size_t) = NULL;
 // runtime configure the probe option
 static void _configure(char* configstr)
 {
-       char buf[64];
        gTraceInfo.optionflag = atoll(configstr);
 
-       sprintf(buf, "configure in probe : %s, %llx\n", configstr, gTraceInfo.optionflag);
        if isOptionEnabled(OPT_SNAPSHOT)
                SCREENSHOT_SET();
        else
                SCREENSHOT_UNSET();
-       PRINTMSG(buf);
+       PRINTMSG("configure in probe : %s, %llx\n", configstr, gTraceInfo.optionflag);
 }
 
 void application_exit()
@@ -126,7 +124,7 @@ static int createSocket(void)
        if (gTraceInfo.socket.daemonSock != -1) {
                memset(&clientAddr, '\0', sizeof(clientAddr));
                clientAddr.sun_family = AF_UNIX;
-               sprintf(clientAddr.sun_path, "%s", UDS_NAME);
+               snprintf(clientAddr.sun_path, sizeof(UDS_NAME), "%s", UDS_NAME);
 
                clientLen = sizeof(clientAddr);
                if (connect(gTraceInfo.socket.daemonSock,
@@ -136,7 +134,7 @@ static int createSocket(void)
                        int recved = 0;
 
                        /* send pid and ppid to manager */
-                       sprintf(buf, "%d %d", getpid(), getppid());
+                       snprintf(buf, sizeof(buf), "%d %d", getpid(), getppid());
                        print_log_str(MSG_PID, buf);
 
                        /* we need recv this messages right now! */
@@ -299,7 +297,7 @@ static void *recvThread(void __unused * data)
                        recvlen = read(g_timerfd, &xtime, sizeof(xtime));
                        if(recvlen > 0)
                        {
-                               log.length = sprintf(log.data, "%ld", g_total_alloc_size);
+                               log.length = snprintf(log.data, sizeof(log.data), "%ld", g_total_alloc_size) + 1;
                                printLog(&log, MSG_ALLOC);
                        }
                        else
@@ -435,8 +433,6 @@ static int create_recv_thread()
 
 void _init_(void)
 {
-       char msg[DA_LOG_MAX];
-
        probeBlockStart();
 
        init_exec_fork();
@@ -458,9 +454,8 @@ void _init_(void)
        }
 
 
-       sprintf(msg, "dynamic analyzer probe helper so loading... pid[%d]\n",
-               getpid());
-       PRINTMSG(msg);
+       PRINTMSG("dynamic analyzer probe helper so loading... pid[%d]\n",
+                getpid());
 
        gTraceInfo.init_complete = 1;
        maps_make();
@@ -485,21 +480,17 @@ void __attribute__((constructor)) _init_probe()
        /* init gl functions */
        __init_gl_functions__();
 
-       char msg[DA_LOG_MAX];
-       sprintf(msg, "<-lib construnctor");
-       PRINTMSG(msg);
+       PRINTMSG("<-lib construnctor");
 }
 
 void _uninit_(void)
 {
        int i;
-       char msg[DA_LOG_MAX];
        probeBlockStart();
 
        gTraceInfo.init_complete = -1;
-       sprintf(msg, "dynamic analyzer probe helper so unloading... pid[%d]\n",
-               getpid());
-       PRINTMSG(msg);
+       PRINTMSG("dynamic analyzer probe helper so unloading... pid[%d]\n",
+                getpid());
 
        remove_all_glist();
 
@@ -534,9 +525,7 @@ void _uninit_(void)
 
 void __attribute__((destructor)) _fini_probe()
 {
-       char msg[DA_LOG_MAX];
-       sprintf(msg, "->lib destructor. pid[%d]\n", getpid());
-       PRINTMSG(msg);
+       PRINTMSG("->lib destructor. pid[%d]\n", getpid());
        _uninit_();
 }
 
@@ -671,12 +660,14 @@ bool print_log_fmt(int msgType, const char *func_name, int line, ...)
 // get backtrace string
 // return stack depth if succeed, otherwise return 0
 // parameter 'log' cannot be null
+/* TODO remove unused code (getBacktraceString)*/
 int getBacktraceString(log_t* log, int bufsize)
 {
        void* array[MAX_STACK_DEPTH];
        char** strings = NULL;
        size_t i, size;
        int initsize;
+       int curlen;
        int stringlen;
 
        if(log == NULL)
@@ -685,7 +676,8 @@ int getBacktraceString(log_t* log, int bufsize)
        probeBlockStart();
 
        initsize = log->length;
-       log->data[log->length] = '\0';  // is this necessary ?
+       curlen = initsize;
+       log->data[curlen] = '\0';       // is this necessary ?
        size = backtrace(array, MAX_STACK_DEPTH);
        if(likely(size > TRIM_STACK_DEPTH))
        {
@@ -696,13 +688,14 @@ int getBacktraceString(log_t* log, int bufsize)
                        for(i = TRIM_STACK_DEPTH; i < size; i++)
                        {
                                stringlen = strlen(strings[i - TRIM_STACK_DEPTH]) + 14;
-                               if(log->length + stringlen >= bufsize + initsize)
+                               if(curlen + stringlen >= bufsize + initsize)
                                        break;
 
-                               log->length += sprintf(log->data + log->length, "%010u`,%s`,", (unsigned int)(array[i]), strings[i - TRIM_STACK_DEPTH]);
+                               curlen += snprintf(log->data + curlen, bufsize - curlen, "%010u`,%s`,", (unsigned int)(array[i]), strings[i - TRIM_STACK_DEPTH]);
                        }
-                       log->data[log->length-2] = '\0';
-                       log->length -= 2;
+                       curlen -= 2;
+                       log->data[curlen] = '\0';
+                       log->length = curlen;
                        free(strings);
                }
                else    // failed to get backtrace symbols
@@ -711,13 +704,14 @@ int getBacktraceString(log_t* log, int bufsize)
                        for(i = TRIM_STACK_DEPTH; i < size; i++)
                        {
                                stringlen = 23;
-                               if(log->length + stringlen >= bufsize + initsize)
+                               if(curlen + stringlen >= bufsize + initsize)
                                        break;
 
-                               log->length += sprintf(log->data + log->length, "%010u`,(unknown)`,", (unsigned int)(array[i]));
+                               curlen += snprintf(log->data + curlen, bufsize - curlen, "%010u`,(unknown)`,", (unsigned int)(array[i]));
                        }
-                       log->data[log->length-2] = '\0';
-                       log->length -= 2;
+                       curlen -= 2;
+                       log->data[curlen] = '\0';
+                       log->length = curlen;
                }
 
                probeBlockEnd();
index a1864caefd31b33ccb70dd7bed203eafb0f8d2d5..99fda6df49b6e6f01124f7bb80c307498332f7ae 100644 (file)
@@ -182,7 +182,7 @@ static char __attribute__((used)) *pack_string_to_file(char *to, const char *st,
                        fwrite(st, data_len, 1, file);
                        fclose(file);
                }
-               sprintf(dst_path_pack, "FILE:%s", template_name);
+               snprintf(dst_path_pack, sizeof(dst_path_pack), "FILE:%s", template_name);
                to = pack_string(to, dst_path_pack);
        }
        return to;
@@ -280,9 +280,7 @@ static char __attribute__((used)) *pack_value_by_type(char *to, const char **t,
                to = pack_array(to, args, sizeof(w));
                break;
        default: {
-               char buf[128];
-               sprintf(buf, "ERROR PACK #%d '%c'!!!", **t, **t);
-               PRINTERR(buf);
+               PRINTERR("ERROR PACK #%d '%c'!!!", **t, **t);
                to--;
                break;
                }
index ae100194e48ad57b4d0a50feb729c94d77797d87..38ac463cbcfcd00d89239bab165a981935863e44 100755 (executable)
@@ -61,13 +61,6 @@ extern int app_efl_main_flg;
 #define ENABLE_INTERNAL_MALLOC         0x0001
 #define ENABLE_SNAPSHOT                                0x0002
 
-#define LOG(FORMAT, ...)                                       \
-       do {                                                                    \
-               char buf[128];                                          \
-               sprintf(buf, FORMAT, __VA_ARGS__);      \
-               PRINTMSG(buf);                                          \
-       } while(0)                                                              \
-
 #define SCREENSHOT_LOCK()                                                                              \
        do {                                                                                                            \
                int old;                                                                                                \
index 50c0d9df0bfca706043fede1cbb91129104554ca..3fc33273314be26d752a2dd2f33e655c2ee00bdf 100644 (file)
        #define TYPEDEF(type) typedef type
 #endif
 
-static char contextValue[MAX_GL_CONTEXT_VALUE_SIZE];
+static char contextValue[MAX_GL_CONTEXT_VALUE_SIZE]; /* maybe it should not be gobal static variable */
 static enum DaOptions _sopt = OPT_GLES;
 static __thread GLenum gl_error_external = GL_NO_ERROR;
 
-static void __ui_array_to_str(char *to, GLuint *arr ,int count)
+static void __ui_array_to_str(char *to, GLuint *arr ,int count, size_t bufsize)
 {
-       int i = 0;
+       int i = 0, len = 0;
 
-       for (i = 0; i < count; i++)
-               to += sprintf(to, "%u, ", *arr++);
+       for (i = 0; i < count; i++) {
+               if (bufsize < sizeof(GLuint) * 4) {
+                       PRINTERR("too small buffer.");
+                       break;
+               }
+
+               len = snprintf(to, bufsize,"%u, ", *arr++);
+
+               to += len;
+               bufsize -= len;
+       }
 
        if (count != 0) {
                to -= 2;
@@ -471,7 +480,7 @@ void REAL_NAME(glDeleteTextures)(GLsizei n, const GLuint *textures)
        CALL_ORIG(glDeleteTextures, n, textures);
        GL_GET_ERROR();
        if (error == GL_NO_ERROR)
-               __ui_array_to_str(buf, (GLuint *)textures, n);
+               __ui_array_to_str(buf, (GLuint *)textures, n, sizeof(buf));
 
        AFTER('v', NO_RETURN_VALUE, APITYPE_CONTEXT, buf, "dp",
              n, voidp_to_uint64(textures));
@@ -649,7 +658,7 @@ void REAL_NAME(glGenBuffers)(GLsizei n, GLuint * buffers)
        CALL_ORIG(glGenBuffers, n, buffers);
        GL_GET_ERROR();
        if (error == GL_NO_ERROR)
-               __ui_array_to_str(buf, buffers, n);
+               __ui_array_to_str(buf, buffers, n, sizeof(buf));
 
        AFTER('v', NO_RETURN_VALUE, APITYPE_CONTEXT, buf, "dp",
              n, voidp_to_uint64(buffers));
@@ -684,7 +693,7 @@ void REAL_NAME(glGenTextures)(GLsizei n, GLuint * textures)
        CALL_ORIG(glGenTextures, n, textures);
        GL_GET_ERROR();
        if (error == GL_NO_ERROR)
-               __ui_array_to_str(buf, textures, n);
+               __ui_array_to_str(buf, textures, n, sizeof(buf));
 
        AFTER('v', NO_RETURN_VALUE, APITYPE_CONTEXT, buf, "dp",
              n, voidp_to_uint64(textures));
@@ -1099,6 +1108,7 @@ void REAL_NAME(glLineWidth)(GLfloat width)
        AFTER('v', NO_RETURN_VALUE, APITYPE_CONTEXT, "", "f", width);
 }
 
+/* TODO refactor snprintf check*/
 void REAL_NAME(glLinkProgram)(GLuint program)
 {
        TYPEDEF(void (*methodType)(GLuint));
@@ -1108,24 +1118,37 @@ void REAL_NAME(glLinkProgram)(GLuint program)
        char buf[512] = "";
        if (error == GL_NO_ERROR) {
                char *to = buf;
-               int i;
+               int i, len;
+               size_t avail;
                GLint activeNum[1];
                GLint maxLength[1];
                GLsizei length[1];
                GLint size[1];
                GLenum type[1];
 
+               avail = sizeof(buf);
+
                real_glGetProgramiv(program, GL_ACTIVE_ATTRIBUTES, activeNum);
                real_glGetProgramiv(program, GL_ACTIVE_ATTRIBUTE_MAX_LENGTH,
                                    maxLength);
 
                char name1[maxLength[0]];
-               to += sprintf(to, "%d", activeNum[0]);
+               len = snprintf(to, avail, "%d", activeNum[0]);
+               to += len;
+               avail -= len;
                for (i = 0; i < activeNum[0]; i++) {
                        real_glGetActiveAttrib(program, i, maxLength[0], length,
                                               size, type, name1);
-                       to += sprintf(to, ",%d,%s,%d,%x", i, name1, size[0],
-                                     type[0]);
+                       len = snprintf(to, avail, ",%d,%s,%d,%x", i, name1, size[0],
+                                      type[0]);
+
+                       if (avail <= (unsigned int)len) {
+                               PRINTERR("fatal. too small buf");
+                               break;
+                       }
+
+                       to += len;
+                       avail -= len;
                }
 
                real_glGetProgramiv(program, GL_ACTIVE_UNIFORMS, activeNum);
@@ -1133,12 +1156,29 @@ void REAL_NAME(glLinkProgram)(GLuint program)
                                    maxLength);
 
                char name2[maxLength[0]];
-               to += sprintf(to, ",%d", activeNum[0]);
+               len = snprintf(to, avail, ",%d", activeNum[0]);
+
+               if (avail <= (unsigned int)len) {
+                       PRINTERR("fatal. too small buf");
+               } else {
+                       to += len;
+                       avail -= len;
+               }
+
                for (i = 0; i < activeNum[0]; i++) {
                        real_glGetActiveUniform(program, i, maxLength[0],
                                                length, size, type, name2);
-                       to += sprintf(to, ",%d,%s,%d,%x", i, name2, size[0],
-                                     type[0]);
+                       len = snprintf(to, avail, ",%d,%s,%d,%x", i, name2,
+                                      size[0], type[0]);
+
+                       if (avail <= (unsigned int)len) {
+                               PRINTERR("fatal. too small buf");
+                               break;
+                       }
+
+                       to += len;
+                       avail -= len;
+
                }
        }
        AFTER('v', NO_RETURN_VALUE, APITYPE_CONTEXT, buf, "d",
@@ -1368,8 +1408,8 @@ void REAL_NAME(glTexParameterfv)(GLenum target, GLenum pname, const GLfloat * pa
        CALL_ORIG(glTexParameterfv, target, pname, params);
        GL_GET_ERROR();
        if (error == GL_NO_ERROR) {
-               char param0[8];
-               sprintf(param0, "%x", (GLenum)params[0]);
+               char param0[sizeof(GLenum) * 4];
+               snprintf(param0, sizeof(param0), "%x", (GLenum)params[0]);
                AFTER('v', NO_RETURN_VALUE, APITYPE_CONTEXT, param0, "xxp",
                      (uint64_t)(target), (uint64_t)(pname),
                      voidp_to_uint64(params));
@@ -1398,8 +1438,8 @@ void REAL_NAME(glTexParameteriv)(GLenum target, GLenum pname, const GLint * para
        CALL_ORIG(glTexParameteriv, target, pname, params);
        GL_GET_ERROR();
        if (error == GL_NO_ERROR) {
-               char param0[8];
-               sprintf(param0, "%x", (GLenum)params[0]);
+               char param0[sizeof(GLenum) * 4];
+               snprintf(param0, sizeof(param0), "%x", (GLenum)params[0]);
                AFTER('v', NO_RETURN_VALUE, APITYPE_CONTEXT, param0, "xxp",
                      (uint64_t)(target), (uint64_t)(pname),
                      voidp_to_uint64(params));
@@ -1659,7 +1699,8 @@ void REAL_NAME(glVertexAttrib1f)(GLuint index, GLfloat v0)
 
        GLfloat cv[4];
        real_glGetVertexAttribfv(index, GL_CURRENT_VERTEX_ATTRIB, cv);
-       sprintf(contextValue, "%f,%f,%f,%f", cv[0], cv[1], cv[2], cv[3]);
+       snprintf(contextValue, sizeof(contextValue), "%f,%f,%f,%f",
+                cv[0], cv[1], cv[2], cv[3]);
 
        GL_GET_ERROR();
        AFTER('v', NO_RETURN_VALUE, APITYPE_CONTEXT, contextValue, "df",
@@ -1674,7 +1715,8 @@ void REAL_NAME(glVertexAttrib2f)(GLuint index, GLfloat v0, GLfloat v1)
 
        GLfloat cv[4];
        real_glGetVertexAttribfv(index, GL_CURRENT_VERTEX_ATTRIB, cv);
-       sprintf(contextValue, "%f,%f,%f,%f", cv[0], cv[1], cv[2], cv[3]);
+       snprintf(contextValue, sizeof(contextValue), "%f,%f,%f,%f",
+                cv[0], cv[1], cv[2], cv[3]);
 
        GL_GET_ERROR();
        AFTER('v', NO_RETURN_VALUE, APITYPE_CONTEXT, contextValue, "dff",
@@ -1689,7 +1731,8 @@ void REAL_NAME(glVertexAttrib3f)(GLuint index, GLfloat v0, GLfloat v1, GLfloat v
 
        GLfloat cv[4];
        real_glGetVertexAttribfv(index, GL_CURRENT_VERTEX_ATTRIB, cv);
-       sprintf(contextValue, "%f,%f,%f,%f", cv[0], cv[1], cv[2], cv[3]);
+       snprintf(contextValue, sizeof(contextValue), "%f,%f,%f,%f",
+                cv[0], cv[1], cv[2], cv[3]);
 
        GL_GET_ERROR();
        AFTER('v', NO_RETURN_VALUE, APITYPE_CONTEXT, contextValue, "dfff",
@@ -1705,7 +1748,8 @@ void REAL_NAME(glVertexAttrib4f)(GLuint index, GLfloat v0, GLfloat v1, GLfloat v
 
        GLfloat cv[4];
        real_glGetVertexAttribfv(index, GL_CURRENT_VERTEX_ATTRIB, cv);
-       sprintf(contextValue, "%f,%f,%f,%f", cv[0], cv[1], cv[2], cv[3]);
+       snprintf(contextValue, sizeof(contextValue), "%f,%f,%f,%f",
+                cv[0], cv[1], cv[2], cv[3]);
 
        GL_GET_ERROR();
        AFTER('v', NO_RETURN_VALUE, APITYPE_CONTEXT, contextValue, "dffff",
@@ -1720,7 +1764,8 @@ void REAL_NAME(glVertexAttrib1fv)(GLuint index, const GLfloat *v)
 
        GLfloat cv[4];
        real_glGetVertexAttribfv(index, GL_CURRENT_VERTEX_ATTRIB, cv);
-       sprintf(contextValue, "%f,%f,%f,%f", cv[0], cv[1], cv[2], cv[3]);
+       snprintf(contextValue, sizeof(contextValue), "%f,%f,%f,%f",
+                cv[0], cv[1], cv[2], cv[3]);
 
        GL_GET_ERROR();
        AFTER('v', NO_RETURN_VALUE, APITYPE_CONTEXT, contextValue,
@@ -1735,7 +1780,8 @@ void REAL_NAME(glVertexAttrib2fv)(GLuint index, const GLfloat *v)
 
        GLfloat cv[4];
        real_glGetVertexAttribfv(index, GL_CURRENT_VERTEX_ATTRIB, cv);
-       sprintf(contextValue, "%f,%f,%f,%f", cv[0], cv[1], cv[2], cv[3]);
+       snprintf(contextValue, sizeof(contextValue), "%f,%f,%f,%f",
+                cv[0], cv[1], cv[2], cv[3]);
 
        GL_GET_ERROR();
        AFTER('v', NO_RETURN_VALUE, APITYPE_CONTEXT, contextValue,
@@ -1750,7 +1796,8 @@ void REAL_NAME(glVertexAttrib3fv)(GLuint index, const GLfloat *v)
 
        GLfloat cv[4];
        real_glGetVertexAttribfv(index, GL_CURRENT_VERTEX_ATTRIB, cv);
-       sprintf(contextValue, "%f,%f,%f,%f", cv[0], cv[1], cv[2], cv[3]);
+       snprintf(contextValue, sizeof(contextValue), "%f,%f,%f,%f",
+                cv[0], cv[1], cv[2], cv[3]);
 
        GL_GET_ERROR();
        AFTER('v', NO_RETURN_VALUE, APITYPE_CONTEXT, contextValue,
@@ -1764,7 +1811,8 @@ void REAL_NAME(glVertexAttrib4fv)(GLuint index, const GLfloat *v)
        CALL_ORIG(glVertexAttrib4fv, index, v);
        GLfloat cv[4];
        real_glGetVertexAttribfv(index, GL_CURRENT_VERTEX_ATTRIB, cv);
-       sprintf(contextValue, "%f,%f,%f,%f", cv[0], cv[1], cv[2], cv[3]);
+       snprintf(contextValue, sizeof(contextValue), "%f,%f,%f,%f",
+                cv[0], cv[1], cv[2], cv[3]);
 
        GL_GET_ERROR();
        AFTER('v', NO_RETURN_VALUE, APITYPE_CONTEXT, contextValue,
index cc6e95bc52e7a4f6d2df10c99c4d90b0bb0e6c97..a918929e0fb0dabe4e5249b2fb582c87f904282c 100755 (executable)
@@ -115,19 +115,23 @@ static unsigned long getTime()
        return (unsigned long)(ts.tv_sec * 10000 + (ts.tv_nsec/100000));
 }
 
+/* TODO refactor close equal code in ifdef/else section */
+/* TODO remove code. it seems unused. */
 #ifdef USING_BACKTRACE
 int profil_backtrace_symbols(log_t *log, int bufsize, int index)
 {
        char **strings = NULL;
        size_t i;
        int initsize;
+       int curlen;
        int stringlen;
 
        if(log == NULL)
                return 0;
 
        initsize = log->length;
-       log->data[log->length] = '\0';  // is this necessary ?
+       curlen = initsize;
+       log->data[curlen] = '\0';       // is this necessary ?
        if(likely(sample_info_array[index].bt_size > PROFIL_TRIM_STACK_DEPTH))
        {
                strings = BACKTRACE_SYMBOLS(sample_info_array[index].bt_array + PROFIL_TRIM_STACK_DEPTH,
@@ -138,15 +142,16 @@ int profil_backtrace_symbols(log_t *log, int bufsize, int index)
                        for(i = PROFIL_TRIM_STACK_DEPTH; i < sample_info_array[index].bt_size; i++)
                        {
                                stringlen = strlen(strings[i - PROFIL_TRIM_STACK_DEPTH]) + 14;
-                               if(log->length + stringlen >= bufsize + initsize)
+                               if(curlen + stringlen >= bufsize + initsize)
                                        break;
 
-                               log->length += sprintf(log->data + log->length, "%010u`,%s`,",
+                               curlen += snprintf(log->data + curlen, bufsize - curlen, "%010u`,%s`,",
                                                (unsigned int)(sample_info_array[index].bt_array[i]),
                                                strings[i - PROFIL_TRIM_STACK_DEPTH]);
                        }
-                       log->data[log->length-2] = '\0';
-                       log->length -= 2;
+                       curlen -= 2;
+                       log->data[curlen] = '\0';
+                       log->length = curlen;
                        free(strings);
                }
                else
@@ -154,14 +159,15 @@ int profil_backtrace_symbols(log_t *log, int bufsize, int index)
                        for(i = PROFIL_TRIM_STACK_DEPTH; i < sample_info_array[index].bt_size; i++)
                        {
                                stringlen = 23;
-                               if(log->length + stringlen >= bufsize + initsize)
+                               if(curlen + stringlen >= bufsize + initsize)
                                        break;
 
-                               log->length += sprintf(log->data + log->length, "%010u`,(unknown)`,",
+                               curlen += snprintf(log->data + curlen, bufsize - curlen, "%010u`,(unknown)`,",
                                                (unsigned int)(sample_info_array[index].bt_array[i]));
                        }
-                       log->data[log->length-2] = '\0';
-                       log->length -= 2;
+                       curlen -= 2;
+                       log->data[curlen] = '\0';
+                       log->length = curlen;
                }
                return (int)(sample_info_array[index].bt_size - PROFIL_TRIM_STACK_DEPTH);
        }
@@ -176,13 +182,15 @@ int profil_backtrace_symbols(log_t *log, int bufsize, int index)
        char **strings = NULL;
        size_t i;
        int initsize;
+       int curlen;
        int stringlen;
 
        if(log == NULL)
                return 0;
 
        initsize = log->length;
-       log->data[log->length] = '\0';  // is this necessary ?
+       curlen = initsize;
+       log->data[curlen] = '\0';       // is this necessary ?
        strings = BACKTRACE_SYMBOLS(sample_info_array[index].bt_array,
                        sample_info_array[index].bt_size);
 
@@ -191,15 +199,16 @@ int profil_backtrace_symbols(log_t *log, int bufsize, int index)
                for(i = 0; i < sample_info_array[index].bt_size; i++)
                {
                        stringlen = strlen(strings[i]) + 14;
-                       if(log->length + stringlen >= bufsize + initsize)
+                       if(curlen + stringlen >= bufsize + initsize)
                                break;
 
-                       log->length += sprintf(log->data + log->length, "%010u`,%s`,",
+                       curlen += snprintf(log->data + curlen, bufsize - curlen, "%010u`,%s`,",
                                        (unsigned int)(sample_info_array[index].bt_array[i]),
                                        strings[i]);
                }
-               log->data[log->length-2] = '\0';
-               log->length -= 2;
+               curlen -= 2;
+               log->data[curlen] = '\0';
+               log->length = curlen;
                free(strings);
        }
        else
@@ -207,14 +216,15 @@ int profil_backtrace_symbols(log_t *log, int bufsize, int index)
                for(i = 0; i < sample_info_array[index].bt_size; i++)
                {
                        stringlen = 23;
-                       if(log->length + stringlen >= bufsize + initsize)
+                       if(curlen + stringlen >= bufsize + initsize)
                                break;
 
-                       log->length += sprintf(log->data + log->length, "%010u`,(unknown)`,",
+                       curlen += snprintf(log->data + curlen, bufsize - curlen, "%010u`,(unknown)`,",
                                        (unsigned int)(sample_info_array[index].bt_array[i]));
                }
-               log->data[log->length-2] = '\0';
-               log->length -= 2;
+               curlen -= 2;
+               log->data[curlen] = '\0';
+               log->length = curlen;
        }
        return (int)(sample_info_array[index].bt_size);
 }