From 5307f0ae0ac08a9490ff62f245c1ffd979ae00f7 Mon Sep 17 00:00:00 2001
From: Oleg Kopysov <o.kopysov@samsung.com>
Date: Fri, 19 May 2017 22:10:49 +0300
Subject: [PATCH] Fix SVACE defects - part 2

File: resource/csdk/security/provisioning/sample/certgenerator.cpp
	-- file handle loss
	-- potential buffer overrun by sprintf call

Change-Id: I12217045b42683b4eac3af03b76c4c189f7a00db
Signed-off-by: Oleksandr Moliavko <o.moliavko@samsung.com>
Signed-off-by: Oleg Kopysov <o.kopysov@samsung.com>
Reviewed-on: https://gerrit.iotivity.org/gerrit/20141
Tested-by: jenkins-iotivity <jenkins@iotivity.org>
Reviewed-by: dongik Lee <dongik.lee@samsung.com>
Reviewed-by: Dmitriy Zhuravlev <d.zhuravlev@samsung.com>
---
 .../security/provisioning/sample/certgenerator.cpp    | 19 +++++++++----------
 1 file changed, 9 insertions(+), 10 deletions(-)

diff --git a/resource/csdk/security/provisioning/sample/certgenerator.cpp b/resource/csdk/security/provisioning/sample/certgenerator.cpp
index 7d97f15..4245b17 100644
--- a/resource/csdk/security/provisioning/sample/certgenerator.cpp
+++ b/resource/csdk/security/provisioning/sample/certgenerator.cpp
@@ -359,14 +359,13 @@ static void DoGenCertificate(CertType certType)
         goto exit;
     }
 
-    sprintf(filename, "%s.crt", subjKeyPairName);
+    snprintf(filename, sizeof(filename), "%s.crt", subjKeyPairName);
     f = fopen(filename, "wb");
     if (NULL == f)
     {
         printf("Failed to open certificate file for writing!\n");
         goto exit;
     }
-    
     bytesProcessed = fwrite(certificate, 1, certificateLen, f);
     if (bytesProcessed < certificateLen)
     {
@@ -374,17 +373,17 @@ static void DoGenCertificate(CertType certType)
         goto exit;
     }
 
-    if (0 != fclose(f))
-    {
-        printf("Warning: failed to close certificate file\n");
-        goto exit;
-    }
-
-    f = NULL;
-
     printf("Wrote certificate file.\n");
 
 exit:
+    if (NULL != f)
+    {
+        if (0 != fclose(f))
+        {
+            printf("Warning: failed to fclose\n");
+        }
+        f = NULL;
+    }
 
     OICFree(serial);
     OICFree(certificate);
-- 
2.7.4