[Fedora-directory-commits] adminserver/admserv/cgi-src40 admpw.c, 1.4, 1.5 config.c, 1.5, 1.6 download.c, 1.4, 1.5 dsconfig.c, 1.4, 1.5 help.c, 1.5, 1.6 htmladmin.c, 1.5, 1.6 listOldSrvs.c, 1.4, 1.5 mergeConfig.cpp, 1.4, 1.5 migrateConfig.c, 1.4, 1.5 monreplication.c, 1.4, 1.5 restartsrv.c, 1.4, 1.5 sec-activate.c, 1.5, 1.6 security.c, 1.6, 1.7 snmpconf.c, 1.4, 1.5 snmpmctl.c, 1.4, 1.5 start_config_ds.c, 1.4, 1.5 statpingserv.c, 1.3, 1.4 stopsrv.c, 1.4, 1.5 ugdsconfig.c, 1.5, 1.6 userinfo.c, 1.3, 1.4 viewda

[Doctor Conrad]

Author: rmeggins

Update of /cvs/dirsec/adminserver/admserv/cgi-src40
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv28761/adminserver/admserv/cgi-src40

Modified Files:
	admpw.c config.c download.c dsconfig.c help.c htmladmin.c 
	listOldSrvs.c mergeConfig.cpp migrateConfig.c monreplication.c 
	restartsrv.c sec-activate.c security.c snmpconf.c snmpmctl.c 
	start_config_ds.c statpingserv.c stopsrv.c ugdsconfig.c 
	userinfo.c viewdata.c viewlog.c 
Log Message:
Bug(s) fixed: 186280
Bug Description: adminserver: Close potential security vulnerabilities 
in CGI code
Reviewed by: Rob, Pete, Nathan, Noriko (Thanks!)
Fix Description: Most of this just involves making sure that we use 
PR_snprintf/PL_strncpyz/PL_strcatn where able, or just making sure we 
use snprintf/strncpy/strncat correctly and null terminate the buffers.  
I also got rid of some dead code, unused variables, and the like.  There 
are a few cases that are more complex that I have specified below.  In 
some cases I had to change the function signature to add a size 
parameter in cases where the function was copying to a given char * and 
the size was assumed (in most cases this was safe but it's still dangerous).
Platforms tested: Fedora Core 5
Flag Day: no
Doc impact: no



Index: admpw.c
===================================================================
RCS file: /cvs/dirsec/adminserver/admserv/cgi-src40/admpw.c,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -r1.4 -r1.5
--- admpw.c	18 Aug 2005 18:59:03 -0000	1.4
+++ admpw.c	31 Mar 2006 22:58:20 -0000	1.5
@@ -112,8 +112,8 @@
 	char resPath[256], *execPath;
 	execPath = getcwd(resPath, 256);
 	if (execPath) {
-		strcpy(resPath, execPath);
-		strcat(resPath, "/property");
+		PL_strncpyz(resPath, execPath, sizeof(resPath));
+		PL_strcatn(resPath, sizeof(resPath), "/property");
 		i18nResource = res_init_resource(resPath, RESOURCE_FILE);
 	}
 	if (getenv("HTTP_ACCEPT_LANGUAGE")) {
@@ -301,7 +301,6 @@
 	FILE *f;
 	int cnt;
 	static char filename[BIG_LINE];
-	static char inbuf[BIG_LINE];
 	static char outbuf[BIG_LINE];
 
 	PR_snprintf(filename, sizeof(filename), "%s/admpw",
getenv("ADMSERV_ROOT"));


Index: config.c
===================================================================
RCS file: /cvs/dirsec/adminserver/admserv/cgi-src40/config.c,v
retrieving revision 1.5
retrieving revision 1.6
diff -u -r1.5 -r1.6
--- config.c	18 Aug 2005 18:59:03 -0000	1.5
+++ config.c	31 Mar 2006 22:58:20 -0000	1.6
@@ -86,7 +86,7 @@
 static int update_conf(char *file, char *name, char *val);
 static int validate_addr(char* ip);
 static int validate_logfile(char* name);
-static int get_logfile_path(char *name, char *buf);
+static int get_logfile_path(char *name, char *buf, size_t bufsize);
 #ifdef XP_UNIX
 static int rename_pidlog_file(PsetHndl pset, char* newname);
 static int change_uid_all(char *dir, int curuid, int newuid);
@@ -132,8 +132,8 @@
 
   execPath = getcwd(resPath, 256);
   if (execPath) {
-    strcpy(resPath, execPath);
-    strcat(resPath, "/property");
+    PL_strncpyz(resPath, execPath, sizeof(resPath));
+    PL_strcatn(resPath, sizeof(resPath), "/property");
     i18nResource = res_init_resource(resPath, RESOURCE_FILE);
   }
   valsbuf[0] = NULL;
@@ -308,14 +308,15 @@
     nl = createAttrNameList(cnt);
     x = 0; i = 0;
     while (inputs[x] && *(inputs[x]) != '\0') {
-      char namebuf[128], *cptr;
-      int j;
-      memset(namebuf, '\0', 128);
-      cptr = inputs[x++];
-      j = 0;
-      while (*cptr != '=') namebuf[j++] = *cptr++;
+      char *begin, *end;
+      begin = inputs[x];
+      end = strchr(inputs[x++], '=');
+      if (end) {
+          char *name = PL_strndup(begin, end-begin);
       /* Ignore "op" */
-      if (strncasecmp(namebuf, "op", 2)) addName(nl, i++, namebuf);
+          if (strncasecmp(name, "op", 2)) addName(nl, i++, name);
+          PL_strfree(name);
+      }
     }
 
     resultList = psetGetAttrList(pset, nl, &errorCode);
@@ -496,12 +497,12 @@
 	    if (valptr && valptr[0] ) {
               char line[BIG_LINE];
               int port = read_adm_conf();
-              snprintf(line, BIG_LINE, "%s:%d", valptr, port);
+              PR_snprintf(line, sizeof(line), "%s:%d", valptr, port);
 	      err = update_conf("console.conf", "Listen", line); 
 	    } else {
               char line[BIG_LINE];
               int port = read_adm_conf();
-              snprintf(line, BIG_LINE, "%d", port);
+              PR_snprintf(line, sizeof(line), "%d", port);
 	      err = update_conf("console.conf", "Listen", line); 
 	    }
 	  }
@@ -523,8 +524,8 @@
 	  else {
 	    char newpath[BIG_LINE];
             char pathline[BIG_LINE];
-	    get_logfile_path(valptr, newpath);
-            snprintf(pathline, BIG_LINE, "%s %s", newpath,
"common");
+            get_logfile_path(valptr, newpath, sizeof(newpath));
+            PR_snprintf(pathline, sizeof(pathline), "%s %s", newpath,
"common");
             err = update_conf("console.conf", "CustomLog",
pathline);
 	  }
 	}
@@ -544,7 +545,7 @@
 	  }
 	  else {
 	    char newpath[BIG_LINE];
-	    get_logfile_path(valptr, newpath);
+	    get_logfile_path(valptr, newpath, sizeof(newpath));
 	    err = update_conf("console.conf", "ErrorLog", newpath);
 	  }
 	}
@@ -707,7 +708,6 @@
   FILE *f;
   static char filename[BIG_LINE];
   static char inbuf[BIG_LINE];
-  static char buf[BIG_LINE];
   static int port = -1;
 
   PR_snprintf(filename, sizeof(filename), "%s/adm.conf",
getenv("ADMSERV_ROOT"));
@@ -753,7 +753,7 @@
   f = fopen(filename, "r");
   if (f==NULL) {
     char msg[BIG_LINE];
-    snprintf(msg, BIG_LINE, "Cannot open file %s for reading", filename);
+    PR_snprintf(msg, BIG_LINE, "Cannot open file %s for reading", filename);
     rpt_err(SYSTEM_ERROR, msg, NULL, NULL);
   }
 
@@ -784,7 +784,7 @@
   f = fopen(filename, "w");
   if (f==NULL) {
     char msg[BIG_LINE];
-    snprintf(msg, BIG_LINE, "Cannot open file %s for writing", filename);
+    PR_snprintf(msg, sizeof(msg), "Cannot open file %s for writing",
filename);
     rpt_err(SYSTEM_ERROR, msg, NULL, NULL);
   }
 
@@ -830,7 +830,6 @@
 static int  change_server_uid(PsetHndl pset, char* newuname) {
   char *sroot = getenv("NETSITE_ROOT");
   int errorCode;
-  static char buf[BIG_LINE];
   int newuid;
   char *olduname = psetGetAttrSingleValue(pset, 
 					  "configuration.nsSuiteSpotUser", 
@@ -1084,7 +1083,7 @@
   FILE *f;
   char fullname[BIG_LINE];
 
-  get_logfile_path(name, fullname);
+  get_logfile_path(name, fullname, sizeof(fullname));
 
   f = fopen(fullname, "a+");
   if (f != NULL) {
@@ -1094,13 +1093,13 @@
   return 0; /* error */
 }
 
-static int get_logfile_path(char *name, char *buf)  {
+static int get_logfile_path(char *name, char *buf, size_t bufsize)  {
 
   if (name[0] == '/') {
-    PR_snprintf(buf, sizeof(buf),"%s",name);
+    PR_snprintf(buf, bufsize,"%s",name);
   }
   else {
-    PR_snprintf(buf, sizeof(buf),"%s/%s", getenv("NETSITE_ROOT"),
name);
+    PR_snprintf(buf, bufsize,"%s/%s", getenv("NETSITE_ROOT"), name);
   }
 
   return 0;


Index: download.c
===================================================================
RCS file: /cvs/dirsec/adminserver/admserv/cgi-src40/download.c,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -r1.4 -r1.5
--- download.c	18 Aug 2005 18:59:03 -0000	1.4
+++ download.c	31 Mar 2006 22:58:20 -0000	1.5
@@ -35,6 +35,7 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include <stdarg.h>
 
 #ifdef XP_UNIX
 #   include <dirent.h>
@@ -74,6 +75,18 @@
 #define DSGW_BLOCK		"<dsgw_menu_block>"
 #define DSGW_BLOCK_CLOSE	"</dsgw_menu_block>"
 
+static int
+safe_snprintf(char *buf, size_t size, const char *fmt, ...)
+{
+    int ret;
+    va_list ap;
+    va_start(ap, fmt);
+    ret = vsnprintf(buf, size, fmt, ap);
+    va_end(ap);
+    buf[size-1] = 0;
+    return ret;
+}
+
 int
 error_exit(char *msg)
 {
@@ -93,7 +106,7 @@
       error_exit("NETSITE_ROOT not found");
 
    /* Check whether dsgw is installed */
-   snprintf(path, sizeof(path), "%s%cdsgw", serverroot, FILE_SEP);
+   safe_snprintf(path, sizeof(path), "%s%cdsgw", serverroot, FILE_SEP);
 
    if (!(dp1 = dir_open(path)))
    {
@@ -120,7 +133,7 @@
 
    /* build list of supported downloads of the form <sr>/dist/<OSname>/n*.zip
*/
 
-   snprintf(path, sizeof(path), "%s%cdist", serverroot, FILE_SEP);
+   safe_snprintf(path, sizeof(path), "%s%cdist", serverroot, FILE_SEP);
 
    baselen = strlen(path);
    
@@ -134,7 +147,7 @@
 	 continue;
      
       /* check if this is a dir and has an executable */
-      snprintf(&(path[baselen]), sizeof(path), "%c%s", FILE_SEP,
dir_name(ep1));
+      safe_snprintf(&(path[baselen]), sizeof(path), "%c%s", FILE_SEP,
dir_name(ep1));
       if (!(dp2 = dir_open(path)))
 	 continue;
       
@@ -148,7 +161,7 @@
              !STRNCASECMP(dir_name(ep2), "winmcc", 6))
 	 {
 	    platforms[count] = STRDUP(dir_name(ep1));
-	    snprintf(line, sizeof(line), "%s:%s", dir_name(ep1), dir_name(ep2));
+	    safe_snprintf(line, sizeof(line), "%s:%s", dir_name(ep1), dir_name(ep2));
 	    paths[count++] = STRDUP(line);
 	 }
       }
@@ -187,7 +200,7 @@
    loc = strtok(strdup(acceptLanguage), ",");
    while (1)
    {
-      snprintf(line, sizeof(line), "..%cjava%chtml%c%c%c%cstart-console.html",
FILE_SEP, FILE_SEP, FILE_SEP, loc[0],loc[1],FILE_SEP);
+      safe_snprintf(line, sizeof(line),
"..%cjava%chtml%c%c%c%cstart-console.html", FILE_SEP, FILE_SEP, FILE_SEP,
loc[0],loc[1],FILE_SEP);
       if ((html = fopen(line, "r")) != NULL)
       {
          break;
@@ -197,7 +210,7 @@
          loc = strtok(NULL, ", ");
          if (loc == NULL)
          {
-            snprintf(line, sizeof(line), "..%cjava%chtml%cstart-console.html",
FILE_SEP, FILE_SEP, FILE_SEP);
+            safe_snprintf(line, sizeof(line),
"..%cjava%chtml%cstart-console.html", FILE_SEP, FILE_SEP, FILE_SEP);
             if ((html = fopen(line, "r")) == NULL)
             {
               error_exit("start-console.html not found");


Index: dsconfig.c
===================================================================
RCS file: /cvs/dirsec/adminserver/admserv/cgi-src40/dsconfig.c,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -r1.4 -r1.5
--- dsconfig.c	18 Aug 2005 18:59:03 -0000	1.4
+++ dsconfig.c	31 Mar 2006 22:58:20 -0000	1.5
@@ -132,8 +132,8 @@
   char resPath[256], *execPath;
   execPath = getcwd(resPath, 256);
   if (execPath) {
-    strcpy(resPath, execPath);
-    strcat(resPath, "/property");
+    PL_strncpyz(resPath, execPath, sizeof(resPath));
+    PL_strcatn(resPath, sizeof(resPath), "/property");
     i18nResource = res_init_resource(resPath, RESOURCE_FILE);
   }
   if (getenv("HTTP_ACCEPT_LANGUAGE")) {


Index: help.c
===================================================================
RCS file: /cvs/dirsec/adminserver/admserv/cgi-src40/help.c,v
retrieving revision 1.5
retrieving revision 1.6
diff -u -r1.5 -r1.6
--- help.c	18 Aug 2005 18:59:03 -0000	1.5
+++ help.c	31 Mar 2006 22:58:20 -0000	1.6
@@ -31,6 +31,7 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include <stdarg.h>
 
 #ifdef XP_UNIX
 #   include <dirent.h>
@@ -85,6 +86,18 @@
 static int debugPrintout = 0;
 static int didContentHeader = 0;
 
+static int
+safe_snprintf(char *buf, size_t size, const char *fmt, ...)
+{
+    int ret;
+    va_list ap;
+    va_start(ap, fmt);
+    ret = vsnprintf(buf, size, fmt, ap);
+    va_end(ap);
+    buf[size-1] = 0;
+    return ret;
+}
+
 int
 parse_query_string(char *qs, char **name[], char **val[])
 {
@@ -230,7 +243,7 @@
       in the server installation  */
    loc = strtok(strdup(localeList), ",");
    while (1){
-      snprintf(path, sizeof(path), "%s%c%c%c", BASE_DIR, FILE_SEP, loc[0],
loc[1]);
+      safe_snprintf(path, sizeof(path), "%s%c%c%c", BASE_DIR, FILE_SEP, loc[0],
loc[1]);
       if (dir_open(path)) {
 /* return only the first 2 characters of the language code e.g. return en for en-US */
 	 loc[2] = '\0';
@@ -239,7 +252,7 @@
       loc = strtok(NULL, ",");
       if (!loc) {
          /* default to English (en)  */
-         snprintf(path, sizeof(path), "%s%c%s", BASE_DIR, FILE_SEP,
DEFAULT_LANG);
+         safe_snprintf(path, sizeof(path), "%s%c%s", BASE_DIR, FILE_SEP,
DEFAULT_LANG);
          if (dir_open(path)) 
             return DEFAULT_LANG;
          else
@@ -255,8 +268,7 @@
 {
    char  path[PATH_LENGTH];
    char  base[PATH_LENGTH];
-   char dir[PATH_LENGTH];
-   char *dirp, *contentp;
+   char *dirp;
    FILE *file  = NULL;
 
    if (debugPrintout)
@@ -266,11 +278,11 @@
 
    /* Open the target file and return the contents */
 
-   snprintf(path, sizeof(path), "%s%c%s%c%s%c%s", BASE_DIR, FILE_SEP, locale,
FILE_SEP,
+   safe_snprintf(path, sizeof(path), "%s%c%s%c%s%c%s", BASE_DIR, FILE_SEP,
locale, FILE_SEP,
 		   product, FILE_SEP, content);
    if (!(file = fopen(path, "r")))
    {
-	   snprintf(path, sizeof(path), "unable to open file: %s", path);
+	   safe_snprintf(path, sizeof(path), "unable to open file: %s", path);
 	   if (debugPrintout)
 	   {
 		   printf("%s<P>\n", path);
@@ -284,14 +296,12 @@
    }
 
    /* spit out the output, inserting a BASE tag into the HEAD block */
-   contentp = content;
-   dirp = dir;
-   while (*contentp && (*contentp != FILE_SEP))
-   {
-	   *dirp++ = *contentp++;
+   if (dirp = strchr(content, FILE_SEP)) {
+       safe_snprintf(base, sizeof(base), "<base
href=\"/%s/%s/%s/help/%.*s/\">", "manual", locale, product,
+                (dirp-content), content);
+   } else {
+       safe_snprintf(base, sizeof(base), "<base
href=\"/%s/%s/%s/help/\">", "manual", locale, product);
    }
-   *dirp = 0;
-   snprintf(base, sizeof(base), "<base
href=\"/%s/%s/%s/help/%s/\">", "manual", locale, product,
dir);
    if (!didContentHeader)
    {
 	   printf("Content-type: text/html\n\n");
@@ -325,7 +335,7 @@
    /* open a frameset file, either from the product dir, or the master file
     * in the help dir. */
 
-   snprintf(path, sizeof(path), "%s%c%s%c%s%c%s", BASE_DIR, FILE_SEP, locale,
FILE_SEP, product, FILE_SEP, FRAMESET_FILE);
+   safe_snprintf(path, sizeof(path), "%s%c%s%c%s%c%s", BASE_DIR, FILE_SEP,
locale, FILE_SEP, product, FILE_SEP, FRAMESET_FILE);
    if (debugPrintout)
    {
 	   printf("opening frameset file: %s<P>\n", path);
@@ -333,7 +343,7 @@
    if (!(frameset = fopen(path, "r")))
    {
       /* product frameset failed, so try global one */
-      snprintf(path, sizeof(path), "%s", FRAMESET_FILE);
+      safe_snprintf(path, sizeof(path), "%s", FRAMESET_FILE);
       if (!(frameset = fopen(path, "r")))
 	  {
 		  if (debugPrintout)
@@ -467,7 +477,7 @@
 	   printf( "Map file parameter: %s<P>\n", mapfile );
    }
 
-   snprintf(path, sizeof(path), "%s%c%s%c%s%c%s", BASE_DIR, FILE_SEP, locale,
+   safe_snprintf(path, sizeof(path), "%s%c%s%c%s%c%s", BASE_DIR, FILE_SEP,
locale,
                         FILE_SEP, product, FILE_SEP, mapfile);
    if (debugPrintout)
    {
@@ -565,7 +575,7 @@
 
    /* first, check for contents.htm in this directory */
 
-   snprintf(path, sizeof(path), "%s%c%s", dirpath, FILE_SEP, CONTENTS_FILE);
+   safe_snprintf(path, sizeof(path), "%s%c%s", dirpath, FILE_SEP,
CONTENTS_FILE);
 
    if ((fp = fopen(path, "r")))
    {
@@ -610,7 +620,7 @@
             dumpTitle(getProductName(dir_name(d)));
          
       }
-      snprintf(path, sizeof(path), "%s%c%s", dirpath, FILE_SEP, dir_name(d));
+      safe_snprintf(path, sizeof(path), "%s%c%s", dirpath, FILE_SEP,
dir_name(d));
       check_directory(path, prefix, suffix, dirDepth+1);
 
       if (dirDepth == 0)
@@ -669,7 +679,7 @@
 
       *endp = '\0';
 
-      snprintf(base, sizeof(base), "%s%c%s", BASE_DIR, FILE_SEP, locale);
+      safe_snprintf(base, sizeof(base), "%s%c%s", BASE_DIR, FILE_SEP, locale);
       check_directory(base, prefix, suffix, 0);
    }
 


Index: htmladmin.c
===================================================================
RCS file: /cvs/dirsec/adminserver/admserv/cgi-src40/htmladmin.c,v
retrieving revision 1.5
retrieving revision 1.6
diff -u -r1.5 -r1.6
--- htmladmin.c	2 Nov 2005 01:15:17 -0000	1.5
+++ htmladmin.c	31 Mar 2006 22:58:20 -0000	1.6
@@ -644,8 +644,8 @@
   while(ptr3[0] == ' ')
     ptr3++; /* remove spaces */
 
-  PR_snprintf(dn, BIG_LINE, "ou=\"%s\", ou=UserPreferences, %s",
binddn, ptr3);
-  PR_snprintf(filter, BIG_LINE,
"(&(objectclass=nscustomview)(nsdisplayname=%s))", view);
+  PR_snprintf(dn, sizeof(dn), "ou=\"%s\", ou=UserPreferences, %s",
binddn, ptr3);
+  PR_snprintf(filter, sizeof(filter),
"(&(objectclass=nscustomview)(nsdisplayname=%s))", view);
 
   ldapError = ldap_search_s(server, dn, LDAP_SCOPE_SUBTREE,
 				filter, NULL, 0, &result);
@@ -659,7 +659,7 @@
   if(!vals || !strcmp(vals[0], "<none>")) {
     /* not in the private views, maybe in the public views? */
     
-    PR_snprintf(dn, BIG_LINE, "ou=Global Preferences, %s", ptr3); 
+    PR_snprintf(dn, sizeof(dn), "ou=Global Preferences, %s", ptr3); 
     ldapError = ldap_search_s(server, dn, LDAP_SCOPE_SUBTREE,
 			      filter, NULL, 0, &result);
     if(ldapError != LDAP_SUCCESS)
@@ -758,7 +758,7 @@
   char *admConf = (char *)malloc(strlen(getenv("ADMSERV_ROOT"))+    
/*<sr>/admin-serv/config*/
 				 strlen("/adm.conf")+1);
   
-  sprintf(admConf, "%s%cadm.conf", getenv("ADMSERV_ROOT"),
FILE_PATHSEP);
+  PR_snprintf(admConf, sizeof(admConf), "%s%cadm.conf",
getenv("ADMSERV_ROOT"), FILE_PATHSEP);
   
   /* get host name(FQDN) and port number from config file */
   f = fopen(admConf, "r");
@@ -797,7 +797,7 @@
   char *admConf = (char *)malloc(strlen(getenv("ADMSERV_ROOT"))+    
/*<sr>/admin-serv/config*/
 				 strlen("/adm.conf")+1);
   
-  sprintf(admConf, "%s%cadm.conf", getenv("ADMSERV_ROOT"),
FILE_PATHSEP);
+  PR_snprintf(admConf, sizeof(admConf), "%s%cadm.conf",
getenv("ADMSERV_ROOT"), FILE_PATHSEP);
   
   /* get host name(FQDN) and port number from config file */
   f = fopen(admConf, "r");
@@ -830,7 +830,7 @@
   char *admConf = (char *)malloc(strlen(getenv("ADMSERV_ROOT"))+    
/*<sr>/admin-serv/config*/
 				 strlen("/adm.conf")+1);
   
-  sprintf(admConf, "%s%cadm.conf", getenv("ADMSERV_ROOT"),
FILE_PATHSEP);
+  PR_snprintf(admConf, sizeof(admConf), "%s%cadm.conf",
getenv("ADMSERV_ROOT"), FILE_PATHSEP);
   
   /* get host name(FQDN) and port number from config file */
   f = fopen(admConf, "r");
@@ -928,13 +928,13 @@
   }
   
   if(accesslog && errorlog && strcmp(accesslog, errorlog))
-    PR_snprintf(dirs, BIG_LINE, "%s|%s", accesslog, errorlog);
+    PR_snprintf(dirs, sizeof(dirs), "%s|%s", accesslog, errorlog);
   else if(accesslog)
-    PL_strncpy(dirs, accesslog, BIG_LINE);
+    PL_strncpyz(dirs, accesslog, sizeof(dirs));
   else if(errorlog)
-    PL_strncpy(dirs, errorlog, BIG_LINE);
+    PL_strncpyz(dirs, errorlog, sizeof(dirs));
   else
-    PR_snprintf(dirs, BIG_LINE, "admin-serv%clogs", FILE_PATHSEP);
+    PR_snprintf(dirs, sizeof(dirs), "admin-serv%clogs", FILE_PATHSEP);
 
   return strdup(dirs);
 }
@@ -970,7 +970,7 @@
 	dirs = strdup(ptr);
       else {
 	dirs = (char *)realloc(dirs, (strlen(dirs) + strlen(ptr) + 1));
-	PR_snprintf(dirs, BIG_LINE, "%s|%s", dirs, ptr);
+	sprintf(dirs, "%s|%s", dirs, ptr);
       }
       ldap_value_free(vals);
     }
@@ -1196,7 +1196,7 @@
 	      continue;
 	    
 	    if(view)
-	      PR_snprintf(viewparam, BIG_LINE, "&view=%s", view);
+	      PR_snprintf(viewparam, sizeof(viewparam), "&view=%s", view);
 
 	    if((vals = ldap_get_values(server, sie_entry, SIE_SERVERID_ATTR)) != NULL) {
 
@@ -1248,6 +1248,7 @@
 		  if(running == 1) {
 		    if(is_local_admin(server_host, server_port[0])) {
 
+              /* if this ever changes, use PR_smprintf instead of malloc + sprintf */
 		      href = (char
*)malloc(strlen(getResourceString(DBT_OUTPUT_TOPOLOGY_LOCAL_SERVER_ENTRY)) +
 					    strlen(admin_url) + 1);
 		      sprintf(href, 
@@ -1256,6 +1257,7 @@
 		    }
 		    else {
 
+              /* if this ever changes, use PR_smprintf instead of malloc + sprintf */
 		      href = (char *)malloc(strlen(getResourceString(DBT_OUTPUT_TOPOLOGY_SERVER_ENTRY))
+
 					    strlen(htmladmin_strdup_escaped(ldap_get_dn(server, sie_entry))) +
 					    (view ? strlen(viewparam) : 0) +
@@ -1268,6 +1270,7 @@
 		  }
 
 
+          /* if this ever changes, use PR_smprintf instead of malloc + sprintf */
           info_link = (char
*)malloc(strlen(getResourceString(DBT_OUTPUT_TOPOLOGY_ADMIN_INFO_LINK)) +
strlen(admin_url) + strlen(htmladmin_strdup_escaped(ldap_get_dn(server, sie_entry))) +
2);
           sprintf(info_link, 
                   (const char*)getResourceString(DBT_OUTPUT_TOPOLOGY_ADMIN_INFO_LINK),
@@ -1275,6 +1278,7 @@
                   htmladmin_strdup_escaped(ldap_get_dn(server, sie_entry)));
 		    
 
+          /* if this ever changes, use PR_smprintf instead of malloc + sprintf */
           log_link = (char
*)malloc(strlen(getResourceString(DBT_OUTPUT_TOPOLOGY_ADMIN_LOG_LINK)) + strlen(admin_url)
+ strlen(htmladmin_strdup_escaped(vals[0])) + strlen(htmladmin_strdup_escaped(dirs)) +
2);
           sprintf(log_link, 
                   (const char*)getResourceString(DBT_OUTPUT_TOPOLOGY_ADMIN_LOG_LINK),
@@ -1301,6 +1305,7 @@
 		running = server_status(server_host, server_port[0]);
 		if(running == 1) {
 
+          /* if this ever changes, use PR_smprintf instead of malloc + sprintf */
 		  href = (char *)malloc(strlen(getResourceString(DBT_OUTPUT_TOPOLOGY_SERVER_RUNNING))
+
 					strlen(htmladmin_strdup_escaped(ldap_get_dn(server, sie_entry))) +
 					(view ? strlen(viewparam) : 0) +
@@ -1312,6 +1317,7 @@
 		}
 		else if(running == 0) {
 
+          /* if this ever changes, use PR_smprintf instead of malloc + sprintf */
 		  href = (char *)malloc(strlen(getResourceString(DBT_OUTPUT_TOPOLOGY_SERVER_STOP)) +
 					strlen(htmladmin_strdup_escaped(ldap_get_dn(server, sie_entry))) +
 					(view ? strlen(viewparam) : 0) +
@@ -1321,16 +1327,19 @@
 			  view ? viewparam : "");
 		}
 
+        /* if this ever changes, use PR_smprintf instead of malloc + sprintf */
         info_link = (char
*)malloc(strlen(getResourceString(DBT_OUTPUT_TOPOLOGY_DIRECTORY_INFO_LINK)) +
strlen(admin_url) + strlen(htmladmin_strdup_escaped(ldap_get_dn(server, sie_entry))) +
2);
         sprintf(info_link, getResourceString(DBT_OUTPUT_TOPOLOGY_DIRECTORY_INFO_LINK),
                 admin_url,
                 htmladmin_strdup_escaped(ldap_get_dn(server, sie_entry)));
 
+        /* if this ever changes, use PR_smprintf instead of malloc + sprintf */
         log_link = (char
*)malloc(strlen(getResourceString(DBT_OUTPUT_TOPOLOGY_DIRECTORY_LOG_LINK)) +
strlen(admin_url) + strlen(htmladmin_strdup_escaped(vals[0])) + 2);
         sprintf(log_link, (const
char*)getResourceString(DBT_OUTPUT_TOPOLOGY_DIRECTORY_LOG_LINK),
                 admin_url,
                 htmladmin_strdup_escaped(vals[0]));
 
+        /* if this ever changes, use PR_smprintf instead of malloc + sprintf */
         repl_link = (char
*)malloc(strlen(getResourceString(DBT_OUTPUT_TOPOLOGY_DIRECTORY_REPL_LINK)) +
strlen(admin_url)*2 + strlen(htmladmin_strdup_escaped(host)) +
strlen(getenv("NETSITE_ROOT")) + /*space for port num*/ 12);
         sprintf(repl_link, (const
char*)getResourceString(DBT_OUTPUT_TOPOLOGY_DIRECTORY_REPL_LINK),
                 admin_url,
@@ -1347,105 +1356,6 @@
 			(running == 1) ? getResourceString(DBT_OUTPUT_TOPOLOGY_ON) : ((running == 0) ?
getResourceString(DBT_OUTPUT_TOPOLOGY_OFF) :
getResourceString(DBT_OUTPUT_TOPOLOGY_UNKNOWN)),
 			(running == 1 || running == 0) ?  href : "");		
 	      }
-	      else if(strstr(ldap_get_dn(server, sie_entry), "Messaging")) {
-		/*
-		 * Messaging Server - logs we get from DS, plus we need to display 3 components under
the SIE:
-		 * imap, pop and smtp. */
-		char *dirs = MS_dirs(server, sie_entry, serverroot);
-		char *services[3];
-		int count;
-		char *service_name;
-
-		services[0] = strdup("IMAP");
-		services[1] = strdup("POP");
-		services[2] = strdup("SMTP");
-		
-
-		if(dirs) {
-		  
-		    info_link = (char
*)malloc(strlen(getResourceString(DBT_OUTPUT_TOPOLOGY_MSG_INFO_LINK)) + strlen(admin_url)
+ strlen(htmladmin_strdup_escaped(ldap_get_dn(server, sie_entry))) + 2);
-		    sprintf(info_link, 
-                    (const char*)getResourceString(DBT_OUTPUT_TOPOLOGY_MSG_INFO_LINK),
-                    admin_url,
-                    htmladmin_strdup_escaped(ldap_get_dn(server, sie_entry)));
-
-		    log_link = (char
*)malloc(strlen(getResourceString(DBT_OUTPUT_TOPOLOGY_MSG_LOG_LINK)) + strlen(admin_url) +
strlen(htmladmin_strdup_escaped(vals[0])) + strlen(htmladmin_strdup_escaped(dirs)) + 2);
-		    sprintf(log_link, (const
char*)getResourceString(DBT_OUTPUT_TOPOLOGY_MSG_LOG_LINK),
-                    admin_url,
-                    htmladmin_strdup_escaped(vals[0]),
-                    htmladmin_strdup_escaped(dirs));
-
-
-		  fprintf(stdout, 
-			  (const char*)getResourceString(DBT_OUTPUT_TOPOLOGY_MSG_LINKS),
-			  info_link,
-			  log_link);
-		}
-
-		for(count=0; count < 3; count++) {
-
-
-		  fprintf(stdout,
-			  (const char*)getResourceString(DBT_OUTPUT_TOPOLOGY_MSG_SERVICE),
-			  services[count]);
-		  
-		  switch(count) {
-		    case 0:
-		      service_name = (char *)malloc(strlen("cn=imap, cn=service, cn=configuration,
") + strlen(ldap_get_dn(server, sie_entry)) + 1);
-		      sprintf(service_name, "cn=imap, cn=service, cn=configuration, %s",
-			      ldap_get_dn(server, sie_entry));
-		      break;
-		    case 1:
-		      service_name = (char *)malloc(strlen("cn=pop, cn=service, cn=configuration,
") + strlen(ldap_get_dn(server, sie_entry)) + 1);
-		      sprintf(service_name, "cn=pop, cn=service, cn=configuration, %s",
-			      ldap_get_dn(server, sie_entry));		      
-		      break;
-		    case 2:
-		      service_name = (char *)malloc(strlen("cn=smtp, cn=service, cn=configuration,
") + strlen(ldap_get_dn(server, sie_entry)) + 1);
-		      sprintf(service_name, "cn=smtp, cn=service, cn=configuration, %s",
-			      ldap_get_dn(server, sie_entry));
-		      break;
-		  }
-
-		  running = server_status(server_host, server_port[count]);
-		  if(running == 1) {
-
-		    href = (char *)malloc(strlen(getResourceString(DBT_OUTPUT_TOPOLOGY_MSG_OFF)) +
-					  strlen(htmladmin_strdup_escaped(service_name)) +
-					  (view ? strlen(viewparam) : 0) +
-					  1);
-		    sprintf(href, 
-			    (const char*)getResourceString(DBT_OUTPUT_TOPOLOGY_MSG_OFF),
-			    htmladmin_strdup_escaped(service_name),
-			    view ? viewparam : "");
-		  }
-		  else if(running == 0) {
-
-		    href = (char *)malloc(strlen(getResourceString(DBT_OUTPUT_TOPOLOGY_MSG_ON)) +
-					  strlen(htmladmin_strdup_escaped(service_name)) +
-					  (view ? strlen(viewparam) : 0) +
-					  1);
-		    sprintf(href, (const char*)getResourceString(DBT_OUTPUT_TOPOLOGY_MSG_ON),
-			    htmladmin_strdup_escaped(service_name),
-			    view ? viewparam : "");
-		  }
-
-
-		  fprintf(stdout, 
-			  (const char*)getResourceString(DBT_OUTPUT_TOPOLOGY_MSG_STATUS),
-			  (running == 1) ? getResourceString(DBT_OUTPUT_TOPOLOGY_ON) : ((running == 0) ?
getResourceString(DBT_OUTPUT_TOPOLOGY_OFF) :
getResourceString(DBT_OUTPUT_TOPOLOGY_UNKNOWN) ),
-			  (running == 1 || running == 0) ? href : ""); 
-
-
- 
-
-
-
-
-		  free(service_name);
-
-		}
-	      }
 	      else if(strstr(ldap_get_dn(server, sie_entry), "Enterprise")) {
 		/* 
 		 * Enterprise Server - local config file.
@@ -1541,55 +1451,6 @@
 			  (running == 1) ? href : "");
 
 	      }
-	      else if((strstr(ldap_get_dn(server, sie_entry), "Application")) ||
-		      (strstr(ldap_get_dn(server, sie_entry), "Biller"))) {
-		/* BillerXpert or NAS - the log directory is hardcoded to <instance-root>/logs
*/
-
-		running = server_status(server_host, server_port[0]);
-		
-		if(running == 1) {
-
-		  href = (char *)malloc(strlen(getResourceString(DBT_OUTPUT_TOPOLOGY_OTHER_ON)) +
-					strlen(htmladmin_strdup_escaped(ldap_get_dn(server, sie_entry))) +
-					(view ? strlen(viewparam) : 0) +
-					1);
-		  sprintf(href, (const char*)getResourceString(DBT_OUTPUT_TOPOLOGY_OTHER_ON),
-			  htmladmin_strdup_escaped(ldap_get_dn(server, sie_entry)),
-			  view ? viewparam : "");
-		}
-		else if(running == 0) {
-
-		  href = (char *)malloc(strlen(getResourceString(DBT_OUTPUT_TOPOLOGY_OTHER_OFF)) +
-					strlen(htmladmin_strdup_escaped(ldap_get_dn(server, sie_entry))) +
-					(view ? strlen(viewparam) : 0) +
-					1);
-		  sprintf(href, (const char*)getResourceString(DBT_OUTPUT_TOPOLOGY_OTHER_OFF),
-			  htmladmin_strdup_escaped(ldap_get_dn(server, sie_entry)),
-			  view ? viewparam : "");
-		}
-
-        info_link = (char
*)malloc(strlen(getResourceString(DBT_OUTPUT_TOPOLOGY_OTHER_INFO_LINK)) +
strlen(admin_url) + strlen(htmladmin_strdup_escaped(ldap_get_dn(server, sie_entry))) +
2);
-        sprintf(info_link, 
-                (const char*)getResourceString(DBT_OUTPUT_TOPOLOGY_OTHER_INFO_LINK),
-                admin_url,
-                htmladmin_strdup_escaped(ldap_get_dn(server, sie_entry)));
-
-        log_link = (char
*)malloc(strlen(getResourceString(DBT_OUTPUT_TOPOLOGY_OTHER_LOG_LINK)) + strlen(admin_url)
+ strlen(htmladmin_strdup_escaped(vals[0])) + strlen(htmladmin_strdup_escaped(vals[0])) +
3);
-        sprintf(log_link, 
-                (const char*)getResourceString(DBT_OUTPUT_TOPOLOGY_OTHER_LOG_LINK),
-                admin_url,
-                htmladmin_strdup_escaped(vals[0]),
-                htmladmin_strdup_escaped(vals[0]),
-                FILE_PATHSEP);
-
-		  fprintf(stdout, 
-			  (const char*)getResourceString(DBT_OUTPUT_TOPOLOGY_STATUS),
-			  info_link,
-			  log_link,
-			  (running == 1) ? getResourceString(DBT_OUTPUT_TOPOLOGY_ON) : ((running == -1) ? 
getResourceString(DBT_OUTPUT_TOPOLOGY_UNKNOWN) :
getResourceString(DBT_OUTPUT_TOPOLOGY_OFF)),
-			  (running == 1) ? href : "");
-
-	      }
 
 	      fprintf(stdout, getResourceString(DBT_OUTPUT_TOPOLOGY_TABLE_FOOTER));
 
@@ -1637,10 +1498,10 @@
 
   nbuf = (bufstruct *) new_buffer(NBUF_SIZE);
 
-  tmp = (unsigned char *)malloc(strlen(binddn) + strlen(bindpw) + 2);
-  auth = (unsigned char *)malloc(2024);
-  sprintf((char *)tmp, "%s:%s", binddn, bindpw);
+  tmp = (unsigned char *)PR_smprintf("%s:%s", binddn, bindpw);
+  auth = (unsigned char *)malloc(strlen((char *)tmp)*2+1);
   do_uuencode(tmp, auth, strlen((char *)tmp));
+  PR_smprintf_free((char *)tmp);
 
   if(strstr(admin_url, "https")) {
     admin_host = strtok(buf+8, ":");
@@ -1751,10 +1612,10 @@
 
   nbuf = (bufstruct *) new_buffer(NBUF_SIZE);
 
-  tmp = (unsigned char *)malloc(strlen(binddn) + strlen(bindpw) + 2);
-  auth = (unsigned char *)malloc(2024);
-  sprintf((char *)tmp, "%s:%s", binddn, bindpw);
+  tmp = (unsigned char *)PR_smprintf("%s:%s", binddn, bindpw);
+  auth = (unsigned char *)malloc(strlen((char *)tmp)*2+1);
   do_uuencode(tmp, auth, strlen((char *)tmp));
+  PR_smprintf_free((char *)tmp);
 
   if(strstr(admin_url, "https")) {
     admin_host = strtok(buf+8, ":");
@@ -1864,7 +1725,7 @@
     
     int rv;
 
-    PR_snprintf(line, BIG_LINE, "%s%cbin/admin/admin/bin/property",
getenv("NETSITE_ROOT"), FILE_PATHSEP);
+    PR_snprintf(line, sizeof(line), "%s%cbin/admin/admin/bin/property",
getenv("NETSITE_ROOT"), FILE_PATHSEP);
     i18nResource = res_init_resource(line, RESOURCE_FILE);
     acceptLanguage = "en";
     if (lang) acceptLanguage = strdup(lang);
@@ -1883,7 +1744,7 @@
        view = get_cgi_var("view", NULL, NULL);
 
        if(view)
-	 PR_snprintf(viewparam, BIG_LINE, "&view=%s", view);
+	 PR_snprintf(viewparam, sizeof(viewparam), "&view=%s", view);
           
        /* In all cases, get the custom view. */
 


Index: listOldSrvs.c
===================================================================
RCS file: /cvs/dirsec/adminserver/admserv/cgi-src40/listOldSrvs.c,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -r1.4 -r1.5
--- listOldSrvs.c	18 Aug 2005 18:59:03 -0000	1.4
+++ listOldSrvs.c	31 Mar 2006 22:58:20 -0000	1.5
@@ -60,7 +60,7 @@
 
 
 int
-readServersList(char* serverRoot, FILE *fstream, char *fileName, char* errorInfo)
+readServersList(char* serverRoot, FILE *fstream, char *fileName, char* errorInfo, size_t
errorSize)
 {
   char		line[1024];
   int		ln;
@@ -75,15 +75,15 @@
     char *v;
 
     ++ln;
-    switch( (t = admutil_getline(fstream, 1024, ln, line))) {
+    switch( (t = admutil_getline(fstream, sizeof(line), ln, line))) {
     case -1:
       fclose(fstream);
       if (i18nResource && 
 	  (errorMsg = res_getstring(i18nResource, 
 				    DBT_ERROR_READ_FILE,
 				    acceptLanguage)))
-	PR_snprintf(errorInfo, sizeof(errorInfo), errorMsg, fileName);
-      else PR_snprintf(errorInfo, sizeof(errorInfo), "Error reading file: %s",
fileName);
+	PR_snprintf(errorInfo, errorSize, errorMsg, fileName);
+      else PR_snprintf(errorInfo, errorSize, "Error reading file: %s",
fileName);
       return 0;
     case 1:
       fclose(fstream);
@@ -122,7 +122,7 @@
 }
 
 char** 
-get_server_list(char* oldServerRoot, char* errorInfo) {
+get_server_list(char* oldServerRoot, char* errorInfo, size_t errorSize) {
 
   PRDir 	*sr;
   PRDirEntry 	*dirname;
@@ -145,14 +145,14 @@
 	  (errMsg = res_getstring(i18nResource, 
 				  DBT_ERROR_OPEN_FILE,
 				  acceptLanguage)))
-	PR_snprintf(errorInfo, sizeof(errorInfo), errMsg, fileName);
+	PR_snprintf(errorInfo, errorSize, errMsg, fileName);
       else 
-        PR_snprintf(errorInfo, sizeof(errorInfo), "Error open file: %s",
fileName);
+        PR_snprintf(errorInfo, errorSize, "Error open file: %s", fileName);
       return 0;
     }
   }
   
-  if (!(result = readServersList(oldServerRoot, fstream, fileName, errorInfo))) {
+  if (!(result = readServersList(oldServerRoot, fstream, fileName, errorInfo,
errorSize))) {
     return NULL;
   }
 
@@ -162,8 +162,8 @@
 	(errMsg = res_getstring(i18nResource, 
 				DBT_ERROR_OPEN_DIR,
 				acceptLanguage)))
-      PR_snprintf(errorInfo, sizeof(errorInfo), errMsg, oldServerRoot);
-    else PR_snprintf(errorInfo, sizeof(errorInfo), "Error open directory: %s",
oldServerRoot);
+      PR_snprintf(errorInfo, errorSize, errMsg, oldServerRoot);
+    else PR_snprintf(errorInfo, errorSize, "Error open directory: %s",
oldServerRoot);
     return NULL;
   }
 
@@ -206,7 +206,7 @@
   char           *nameptr, *valptr, *val;
   char           error_info[128];
   int            setFlag = 0, getFlag = 0, forceSetFlag = 0;
-  char           resPath[256], *execPath, *tmpptr;
+  char           *execPath, *tmpptr;
   char           *lang = getenv("HTTP_ACCEPT_LANGUAGE");
   const char     *errMsg = NULL;
 #if 0
@@ -275,7 +275,7 @@
     else rpt_err(INCORRECT_USAGE, "No old server root specified", NULL, NULL);
   }
 
-  server_list = get_server_list(oldSR, error_info);
+  server_list = get_server_list(oldSR, error_info, sizeof(error_info));
 
   if (server_list) {
     rpt_success(NULL);


Index: mergeConfig.cpp
===================================================================
RCS file: /cvs/dirsec/adminserver/admserv/cgi-src40/mergeConfig.cpp,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -r1.4 -r1.5
--- mergeConfig.cpp	29 Mar 2006 02:19:52 -0000	1.4
+++ mergeConfig.cpp	31 Mar 2006 22:58:20 -0000	1.5
@@ -311,14 +311,14 @@
     while((start_ptr && *start_ptr != '\0') && 
 	  (end_ptr && *end_ptr != '\0')) {
       end_ptr[0] = '\0';
-      strcat(replace_string, start_ptr);
-      strcat(replace_string, dest_groupDN);
+      PL_strcatn(replace_string, sizeof(replace_string), start_ptr);
+      PL_strcatn(replace_string, sizeof(replace_string), dest_groupDN);
       start_ptr = end_ptr + strlen(source_groupDN);
       if(start_ptr && *start_ptr != '\0')
 	end_ptr = strstr(start_ptr, source_groupDN);
     }
     if(start_ptr && *start_ptr!= '\0')
-      strcat(replace_string, start_ptr);
+      PL_strcatn(replace_string, sizeof(replace_string), start_ptr);
 
     free(temp_string);
     free(attribute_list[i]);
@@ -363,7 +363,7 @@
   }
      
   while(merge_rules[count]) {
-    sprintf(temp, "{%s}", attrName);
+    PR_snprintf(temp, sizeof(temp), "{%s}", attrName);
     if(strstr(merge_rules[count], temp))
       break;
     count++;
@@ -646,11 +646,11 @@
       source_entry = ldap_next_entry(source_server, source_entry)) {
     
     next_source_dn = ldap_get_dn(source_server, source_entry);
-    strcpy(temp, next_source_dn);
+    PL_strncpyz(temp, next_source_dn, sizeof(temp));
     temp2 = strchr(temp, ',');
     temp2[2] = '\0'; // include the space
-    strcpy(next_dest_dn, temp);
-    strcat(next_dest_dn, dest_pref_dn);
+    PL_strncpyz(next_dest_dn, temp, sizeof(next_dest_dn));
+    PL_strcatn(next_dest_dn, sizeof(next_dest_dn), dest_pref_dn);
     
     if(recursive_mergeGlobalPrefs(source_server,
 				  next_source_dn,
@@ -816,7 +816,7 @@
     /* ---------------------- INIT i18n ---------------------------------------- */
 
     char *lang=getenv("HTTP_ACCEPT_LANGUAGE");
-    sprintf(line, "%s%cbin/admin/admin/bin/property", server_root,
FILE_PATHSEP);
+    PR_snprintf(line, sizeof(line), "%s%cbin/admin/admin/bin/property",
server_root, FILE_PATHSEP);
     i18nResource = res_init_resource(line, RESOURCE_FILE);
     acceptLanguage = "en";
     if (lang) acceptLanguage = strdup(lang);
@@ -848,7 +848,7 @@
     
     if (source_binddn) rv = ADM_GetCurrentPassword(&err, &source_bindpw);
 
-    sprintf(admroot, "%s%cadmin-serv%cconfig", 
+    PR_snprintf(admroot, sizeof(admroot), "%s%cadmin-serv%cconfig", 
 	    server_root,
 	    FILE_PATHSEP,
 	    FILE_PATHSEP);
@@ -861,7 +861,7 @@
     
     rv = ADMSSL_InitSimple();
     if (rv) {
-      sprintf(error_info, getResourceString(DBT_ADMSSL_INITFAIL), rv);
+      PR_snprintf(error_info, sizeof(error_info), getResourceString(DBT_ADMSSL_INITFAIL),
rv);
       rpt_err(APP_ERROR, error_info, NULL, NULL);
     }
     
@@ -899,8 +899,7 @@
       rpt_err(ELEM_MISSING, getResourceString(DBT_NO_SOURCE_GROUPDN), NULL, NULL);
 
 
-    char *dest_basedn = (char *)malloc((strlen(dest_domain) + 20) * sizeof(char));
-    sprintf(dest_basedn, "ou=%s, o=NetscapeRoot", dest_domain);
+    char *dest_basedn = PR_smprintf("ou=%s, o=NetscapeRoot", dest_domain);
 
     temp = strdup(source_groupdn);
     char *source_basedn = strtok(temp, ",");
@@ -910,13 +909,13 @@
     if(source_basedn[0] == ' ')
       source_basedn = &(source_basedn[1]);
 
-    sprintf(dest_url, "ldap%s://%s:%s/%s",
+    PR_snprintf(dest_url, sizeof(dest_url), "ldap%s://%s:%s/%s",
 	    (!strcmp(dest_secure, "1") ? "s" : ""),
 	    dest_host,
 	    dest_port,
 	    dest_basedn);
 
-    sprintf(source_url, "ldap%s://%s:%d/%s",
+    PR_snprintf(source_url, sizeof(source_url), "ldap%s://%s:%d/%s",
 	    ((admldapGetSecurity(ldapInfo)) ? "s" : ""),
 	    admldapGetHost(ldapInfo),
 	    admldapGetPort(ldapInfo),
@@ -1072,15 +1071,15 @@
 	  isie_created = 1;
 	}
 	
-	strcat(sie_response, "SIE:");
-	strcat(sie_response, sieEntry->entryDN());
-	strcat(sie_response, "%0A");
+	PL_strcatn(sie_response, sizeof(sie_response), "SIE:");
+	PL_strcatn(sie_response, sizeof(sie_response), sieEntry->entryDN());
+	PL_strcatn(sie_response, sizeof(sie_response), "%0A");
 
       } /* creating SIE's for current ISIE */
 	
-      strcat(isie_response, "ISIE:");
-      strcat(isie_response, appEntry->entryDN());
-      strcat(isie_response, "%0A");
+      PL_strcatn(isie_response, sizeof(isie_response), "ISIE:");
+      PL_strcatn(isie_response, sizeof(isie_response), appEntry->entryDN());
+      PL_strcatn(isie_response, sizeof(isie_response), "%0A");
 
 
       /* ------------------------- MERGE ALL ENTRIES UNDER CURRENT ISIE
--------------------------- */
@@ -1143,10 +1142,10 @@
       char source_pref_dn[BIG_LINE];
       char dest_pref_dn[BIG_LINE];
 
-      strcpy(source_pref_dn, "ou=Global Preferences, ");
-      strcat(source_pref_dn, source_basedn);
-      strcpy(dest_pref_dn, "ou=Global Preferences, ");
-      strcat(dest_pref_dn, dest_basedn);
+      PL_strncpyz(source_pref_dn, "ou=Global Preferences, ",
sizeof(source_pref_dn));
+      PL_strcatn(source_pref_dn, sizeof(source_pref_dn), source_basedn);
+      PL_strncpyz(dest_pref_dn, "ou=Global Preferences, ",
sizeof(dest_pref_dn));
+      PL_strcatn(dest_pref_dn, sizeof(dest_pref_dn), dest_basedn);
 
       if(mergeGlobalPrefs(admldapGetHost(ldapInfo),
 			  admldapGetPort(ldapInfo),
@@ -1169,7 +1168,7 @@
 
   } /* GET */
 
-  sprintf(response,
+  PR_snprintf(response, sizeof(response),
 	  "%s%s",
 	  sie_response,
 	  isie_response);


Index: migrateConfig.c
===================================================================
RCS file: /cvs/dirsec/adminserver/admserv/cgi-src40/migrateConfig.c,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -r1.4 -r1.5
--- migrateConfig.c	18 Aug 2005 18:59:03 -0000	1.4
+++ migrateConfig.c	31 Mar 2006 22:58:20 -0000	1.5
@@ -140,8 +140,8 @@
 
   execPath = getcwd(resPath, 256);
   if (execPath) {
-    strcpy(resPath, execPath);
-    strcat(resPath, "/property");
+    PL_strncpyz(resPath, execPath, sizeof(resPath));
+    PL_strcatn(resPath, sizeof(resPath), "/property");
     i18nResource = res_init_resource(resPath, RESOURCE_FILE);
   }
 
@@ -349,12 +349,12 @@
 	    if (val) {
 	      char  urlBuf[256];
 	      char  *tmpptr;
-	      PL_strcpy(urlBuf, val);
+	      PL_strncpyz(urlBuf, val, sizeof(urlBuf));
 	      tmpptr = PL_strrchr(urlBuf, ':');
 	      if (tmpptr) {
 		tmpptr++;
 		*tmpptr = '\0';
-		PL_strcat(urlBuf, valptr);
+		PL_strcatn(urlBuf, sizeof(urlBuf), valptr);
 		addSingleValueAttribute(updateList, i++, "adminurl", urlBuf);
 	      }
 	    }
@@ -430,7 +430,6 @@
   char *lines[50];
   int port;
   const char     *errMsg = NULL;
-  char           error_info[128];
 
   PR_snprintf(filename, sizeof(filename), "%s/adm.conf",
getenv("ADMSERV_ROOT"));
 
@@ -480,8 +479,6 @@
   int linecnt=0;	
   char *lines[50];
   int port;
-  const char     *errMsg = NULL;
-  char           error_info[128];
 
   PR_snprintf(filename, sizeof(filename), "%s/magnus.conf",
getenv("ADMSERV_ROOT"));
 


Index: monreplication.c
===================================================================
RCS file: /cvs/dirsec/adminserver/admserv/cgi-src40/monreplication.c,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -r1.4 -r1.5
--- monreplication.c	18 Aug 2005 18:59:03 -0000	1.4
+++ monreplication.c	31 Mar 2006 22:58:20 -0000	1.5
@@ -58,8 +58,8 @@
 	char resPath[256], *execPath;
 	execPath = getcwd(resPath, 256);
 	if (execPath) {
-		strcpy(resPath, execPath);
-		strcat(resPath, "/property");
+		PL_strncpyz(resPath, execPath, sizeof(resPath));
+		PL_strcatn(resPath, sizeof(resPath), "/property");
 		i18nResource = res_init_resource(resPath, RESOURCE_FILE);
 	}
 	if (getenv("HTTP_ACCEPT_LANGUAGE")) {


Index: restartsrv.c
===================================================================
RCS file: /cvs/dirsec/adminserver/admserv/cgi-src40/restartsrv.c,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -r1.4 -r1.5
--- restartsrv.c	18 Aug 2005 18:59:03 -0000	1.4
+++ restartsrv.c	31 Mar 2006 22:58:20 -0000	1.5
@@ -121,8 +121,8 @@
 
   execPath = getcwd(resPath, 256);
   if (execPath) {
-    strcpy(resPath, execPath);
-    strcat(resPath, "/property");
+    PL_strncpyz(resPath, execPath, sizeof(resPath));
+    PL_strcatn(resPath, sizeof(resPath), "/property");
     i18nResource = res_init_resource(resPath, RESOURCE_FILE);
   }
 
@@ -256,11 +256,8 @@
 #ifdef XP_UNIX
 static char * get_admserv_pid() {
 	char path[BIG_LINE];
-	char newpath[BIG_LINE];
 	char *pidlog = (char*)get_pid_file();
-	char *sroot = getenv("NETSITE_ROOT");
 	char inbuf[16];
-	int errorCode;
 	FILE *f;
 
 	PR_snprintf(path, sizeof(path), "%s", pidlog);


Index: sec-activate.c
===================================================================
RCS file: /cvs/dirsec/adminserver/admserv/cgi-src40/sec-activate.c,v
retrieving revision 1.5
retrieving revision 1.6
diff -u -r1.5 -r1.6
--- sec-activate.c	18 Nov 2005 21:15:03 -0000	1.5
+++ sec-activate.c	31 Mar 2006 22:58:20 -0000	1.6
@@ -124,11 +124,9 @@
 
   if (value) {
   } else {
-    char * msg = getResourceString(DBT_CGI_MISSING_ARGS);
-    char * scratch = (char *) malloc(strlen(msg) + strlen(var) + 1);
-    sprintf(scratch, msg, var);
+    char * scratch = PR_smprintf(getResourceString(DBT_CGI_MISSING_ARGS), var);
     rpt_err(INCORRECT_USAGE, scratch, 0, 0);
-    free((void *) scratch); /* never executed */
+    PR_smprintf_free(scratch); /* never executed */
   }
 
   return value;
@@ -182,7 +180,7 @@
  * Returns 0 on success, -1 on failure.
  */
 
-int get_cert_nickname(char *buf) {
+int get_cert_nickname(char *buf, size_t bufsize) {
   
   char *list_of_families;
   char *family_name;
@@ -201,7 +199,7 @@
     if((temp = get_cgi_var(cgi_var_name, "", "")) == NULL) {
       return -1;
     }
-    strcpy(buf, temp);
+    PL_strncpyz(buf, temp, bufsize);
     return 0;
     /*family_name = PORT_Strtok(NULL, ",");*/
   }
@@ -238,7 +236,7 @@
     PR_snprintf(temp, sizeof(temp), "security=%s\n", val);
   else
     PR_snprintf(temp, sizeof(temp), "security=off\n");
-  strcat(temp_return, temp);
+  PL_strcatn(temp_return, sizeof(temp_return), temp);
 
   if((family_list = psetGetChildren(pset, "configuration.Encryption",
&errorCode))) {
     
@@ -262,7 +260,7 @@
 					    &errorCode);
 
       if((!val) || (!token) || (!personality)) {
-	strcat(temp_return, "familyList=NULL\n");
+	PL_strcatn(temp_return, sizeof(temp_return), "familyList=NULL\n");
 	*return_string = PORT_Strdup(temp_return);
 	return -1;
       }
@@ -271,19 +269,19 @@
       family_name++;
 	
       PR_snprintf(temp, sizeof(temp), "familyList=%s\n", family_name);
-      strcat(temp_return, temp);
+      PL_strcatn(temp_return, sizeof(temp_return), temp);
 
       PR_snprintf(temp, sizeof(temp), "%s-activated=%s\n", family_name, val);
-      strcat(temp_return, temp);
+      PL_strcatn(temp_return, sizeof(temp_return), temp);
 
       PR_snprintf(temp, sizeof(temp), "%s-token=%s\n", family_name, token);
-      strcat(temp_return, temp);
+      PL_strcatn(temp_return, sizeof(temp_return), temp);
 
       PR_snprintf(temp, sizeof(temp), "%s-cert=%s\n", family_name,
personality);
-      strcat(temp_return, temp);
+      PL_strcatn(temp_return, sizeof(temp_return), temp);
     }
   }
-  strcat(temp_return, "familyList=NULL\n");
+  PL_strcatn(temp_return, sizeof(temp_return), "familyList=NULL\n");
 
   /* get cipher preferences */
   
@@ -291,46 +289,46 @@
   val = psetGetAttrSingleValue(pset,
 			       "configuration.encryption.nsSSL2",
 			       &errorCode);
-  strcat(temp_return, "ssl2-activated=");
+  PL_strcatn(temp_return, sizeof(temp_return), "ssl2-activated=");
   if(val)
-    strcat(temp_return, val);
-  strcat(temp_return, "\n");
+    PL_strcatn(temp_return, sizeof(temp_return), val);
+  PL_strcatn(temp_return, sizeof(temp_return), "\n");
 
   val = NULL;
   val = psetGetAttrSingleValue(pset,
 			       "configuration.encryption.nsSSL2Ciphers",
 			       &errorCode);
-  strcat(temp_return, "ssl2=");
+  PL_strcatn(temp_return, sizeof(temp_return), "ssl2=");
   if(val) 
-    strcat(temp_return, val);
-  strcat(temp_return, "\n");
+    PL_strcatn(temp_return, sizeof(temp_return), val);
+  PL_strcatn(temp_return, sizeof(temp_return), "\n");
 
   val = NULL;
   val = psetGetAttrSingleValue(pset,
 			       "configuration.encryption.nsSSL3",
 			       &errorCode);
-  strcat(temp_return, "ssl3-activated=");
+  PL_strcatn(temp_return, sizeof(temp_return), "ssl3-activated=");
   if(val)
-    strcat(temp_return, val);
-  strcat(temp_return, "\n");
+    PL_strcatn(temp_return, sizeof(temp_return), val);
+  PL_strcatn(temp_return, sizeof(temp_return), "\n");
 
   val = NULL;
   val = psetGetAttrSingleValue(pset,
 			       "configuration.encryption.nsSSL3Ciphers",
 			       &errorCode);
-  strcat(temp_return, "ssl3=");
+  PL_strcatn(temp_return, sizeof(temp_return), "ssl3=");
   if(val)
-    strcat(temp_return, val);
-  strcat(temp_return, "\n");
+    PL_strcatn(temp_return, sizeof(temp_return), val);
+  PL_strcatn(temp_return, sizeof(temp_return), "\n");
 
   val = NULL;
   val = psetGetAttrSingleValue(pset,
 			       "configuration.encryption.nsSSLClientAuth",
 			       &errorCode);
-  strcat(temp_return, "clientauth=");
+  PL_strcatn(temp_return, sizeof(temp_return), "clientauth=");
   if(val)
-    strcat(temp_return, val);
-  strcat(temp_return, "\n");
+    PL_strcatn(temp_return, sizeof(temp_return), val);
+  PL_strcatn(temp_return, sizeof(temp_return), "\n");
   
   *return_string = PORT_Strdup(temp_return);
   return 0;
@@ -609,7 +607,7 @@
 
     /* get all variables */
     rv = GetSSLFamilyAttributes(pset, &return_string);
-    fprintf(stdout, return_string);
+    fputs(return_string, stdout);
     free(return_string);
   }
   else if (!PORT_Strcmp(method, "POST")) {
@@ -631,11 +629,9 @@
     get_family_input(&family_head);
 
     if((trustdb = get_cgi_var(trustdbVN, "", "")) == NULL) {
-      char * msg = getResourceString(DBT_CGI_MISSING_ARGS);
-      char * scratch = (char *) malloc(strlen(msg) + sizeof(trustdbVN));
-      sprintf(scratch, msg, trustdbVN);
+      char * scratch = PR_smprintf(getResourceString(DBT_CGI_MISSING_ARGS), trustdbVN);
       rpt_err(ELEM_MISSING, NULL, scratch, NULL);
-      free((void *) scratch); /* never executed */
+      PR_smprintf_free(scratch); /* never executed */
     }
 
     /* SET SSL VARIABLES via pset  */
@@ -666,12 +662,10 @@
       char protocols[BIG_LINE];
       char ciphers[BIG_LINE];
 
-      if  (get_cert_nickname(certnickname) < 0) {
-	char * msg = getResourceString(DBT_CGI_MISSING_ARGS);
-	char * scratch = (char *) malloc(strlen(msg) + strlen(certnickname) + 1);
-	sprintf(scratch, msg, certnickname);
+      if  (get_cert_nickname(certnickname, sizeof(certnickname)) < 0) {
+	char * scratch = PR_smprintf(getResourceString(DBT_CGI_MISSING_ARGS), certnickname);
 	rpt_err(ELEM_MISSING, NULL, scratch, NULL);
-	free((void *) scratch); /* never executed */
+	PR_smprintf_free(scratch); /* never executed */
       }
       if (strlen(clientauth) == 0) {
 	clientauth = (char*)"off";
@@ -689,7 +683,8 @@
 
       rv = update_conf("console.conf", "NSSProtocol", protocols);
 
-      snprintf(ciphers, BIG_LINE, "%s,%s", ssl2, ssl3);
+      snprintf(ciphers, sizeof(ciphers), "%s,%s", ssl2, ssl3);
+      ciphers[sizeof(ciphers)-1] = 0;
       rv = update_conf("console.conf", "NSSCipherSuite", ciphers);
 
       if (!strcmp(clientauth, "on"))


Index: security.c
===================================================================
RCS file: /cvs/dirsec/adminserver/admserv/cgi-src40/security.c,v
retrieving revision 1.6
retrieving revision 1.7
diff -u -r1.6 -r1.7
--- security.c	1 Feb 2006 23:03:57 -0000	1.6
+++ security.c	31 Mar 2006 22:58:20 -0000	1.7
@@ -1010,10 +1010,12 @@
 
  loser:
   if (privateKey==NULL) {
-    char tmpLine[BIG_LINE];
+    char *tmpLine = NULL;
 
+    tmpLine = (char *)PR_Malloc(PR_GetErrorTextLength()+1);
     PR_GetErrorText(tmpLine);
     PR_snprintf(line, sizeof(line), "%d:%s", PR_GetError(), tmpLine);
+    PR_Free(tmpLine);
 
     rpt_err(GENERAL_FAILURE, 
             getResourceString(DBT_INTERNAL_ERROR), 
@@ -1231,9 +1233,12 @@
 
   if (rv != SECSuccess) {
     {
-      char tmpLine[BIG_LINE];
+      char *tmpLine;
+
+      tmpLine = (char *)PR_Malloc(PR_GetErrorTextLength()+1);
       PR_GetErrorText(tmpLine);
       PR_snprintf(line, sizeof(line), "%d:%s", PR_GetError(), tmpLine);
+      PR_Free(tmpLine);
     }
     /* if unable to import report error */
     rpt_err(SYSTEM_ERROR, 


Index: snmpconf.c
===================================================================
RCS file: /cvs/dirsec/adminserver/admserv/cgi-src40/snmpconf.c,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -r1.4 -r1.5
--- snmpconf.c	18 Aug 2005 18:59:03 -0000	1.4
+++ snmpconf.c	31 Mar 2006 22:58:20 -0000	1.5
@@ -115,8 +115,8 @@
 	char resPath[256], *execPath;
 	execPath = getcwd(resPath, 256);
 	if (execPath) {
-		strcpy(resPath, execPath);
-		strcat(resPath, "/property");
+		PL_strncpyz(resPath, execPath, sizeof(resPath));
+		PL_strcatn(resPath, sizeof(resPath), "/property");
 		i18nResource = res_init_resource(resPath, RESOURCE_FILE);
 	}
 	if (getenv("HTTP_ACCEPT_LANGUAGE")) {
@@ -396,7 +396,6 @@
 
 void update_manager_list(char *manager, char *configfile) {
 	char *comma, *tab1, *tab2, *entry, *name, *trap_port, *community;
-	char op_buf[128];
 	
 	manager_list * list = NULL;
 


Index: snmpmctl.c
===================================================================
RCS file: /cvs/dirsec/adminserver/admserv/cgi-src40/snmpmctl.c,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -r1.4 -r1.5
--- snmpmctl.c	18 Aug 2005 18:59:03 -0000	1.4
+++ snmpmctl.c	31 Mar 2006 22:58:20 -0000	1.5
@@ -133,8 +133,8 @@
 	char resPath[256], *execPath;
 	execPath = getcwd(resPath, 256);
 	if (execPath) {
-		strcpy(resPath, execPath);
-		strcat(resPath, "/property");
+		PL_strncpyz(resPath, execPath, sizeof(resPath));
+		PL_strcatn(resPath, sizeof(resPath), "/property");
 		i18nResource = res_init_resource(resPath, RESOURCE_FILE);
 	}
 	if (getenv("HTTP_ACCEPT_LANGUAGE")) {
@@ -162,7 +162,6 @@
 int main(int argc, char *argv[])
 {
     int _ai = ADMUTIL_Init();
-    char line[BIG_LINE];
     char *method = getenv("REQUEST_METHOD");
 	char *qs=0;
     char *root = getenv("NETSITE_ROOT");
@@ -410,7 +409,6 @@
    char command[BIG_LINE];
    char path[PATH_MAX];
    FILE *fhdl;
-   char buffer[20];
    char *ADMSERV_ROOT = getenv("ADMSERV_ROOT");
    pid_t  magtid;
 
@@ -524,7 +522,6 @@
     char errlog[PATH_MAX];
     FILE *fhdl;
     pid_t  magtid;
-    char buffer[20];
 	char err_text[128];
     int ret=0;
 


Index: start_config_ds.c
===================================================================
RCS file: /cvs/dirsec/adminserver/admserv/cgi-src40/start_config_ds.c,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -r1.4 -r1.5
--- start_config_ds.c	18 Aug 2005 18:59:03 -0000	1.4
+++ start_config_ds.c	31 Mar 2006 22:58:20 -0000	1.5
@@ -112,6 +112,7 @@
       return error_exit("NETSITE_ROOT not found");
 
    snprintf(path, sizeof(path), "%s%c%s", admroot, FILE_SEP,
ADMIN_CONFIG_FILE);
+   path[sizeof(path)-1] = 0;
 
    if (!(configfile = fopen(path, "r")))
       return error_exit("Failed to open adm.conf");
@@ -137,6 +138,7 @@
 	 p++;
 
       snprintf(path, sizeof(path), "%s%c%s", srvroot, FILE_SEP, p);
+      path[sizeof(path)-1] = 0;
       
       /* this should probably be an explicit fork/exec, but I don't have the time...
*/
       if ((ret_val = system(path)) == -1)


Index: statpingserv.c
===================================================================
RCS file: /cvs/dirsec/adminserver/admserv/cgi-src40/statpingserv.c,v
retrieving revision 1.3
retrieving revision 1.4
diff -u -r1.3 -r1.4
--- statpingserv.c	18 Aug 2005 18:59:03 -0000	1.3
+++ statpingserv.c	31 Mar 2006 22:58:20 -0000	1.4
@@ -57,7 +57,6 @@
 {
   int _ai = ADMUTIL_Init();
   char *m;
-  char msg[BIG_LINE];
 
   char *qs = getenv("QUERY_STRING");
   PRHostEnt   hent;


Index: stopsrv.c
===================================================================
RCS file: /cvs/dirsec/adminserver/admserv/cgi-src40/stopsrv.c,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -r1.4 -r1.5
--- stopsrv.c	18 Aug 2005 18:59:03 -0000	1.4
+++ stopsrv.c	31 Mar 2006 22:58:20 -0000	1.5
@@ -81,8 +81,8 @@
 
   execPath = getcwd(resPath, 256);
   if (execPath) {
-    strcpy(resPath, execPath);
-    strcat(resPath, "/property");
+    PL_strncpyz(resPath, execPath, sizeof(resPath));
+    PL_strcatn(resPath, sizeof(resPath), "/property");
     i18nResource = res_init_resource(resPath, RESOURCE_FILE);
   }
 


Index: ugdsconfig.c
===================================================================
RCS file: /cvs/dirsec/adminserver/admserv/cgi-src40/ugdsconfig.c,v
retrieving revision 1.5
retrieving revision 1.6
diff -u -r1.5 -r1.6
--- ugdsconfig.c	28 Oct 2005 22:43:29 -0000	1.5
+++ ugdsconfig.c	31 Mar 2006 22:58:20 -0000	1.6
@@ -137,8 +137,8 @@
 	char resPath[256], *execPath;
 	execPath = getcwd(resPath, 256);
 	if (execPath) {
-		strcpy(resPath, execPath);
-		strcat(resPath, "/property");
+		PL_strncpyz(resPath, execPath, sizeof(resPath));
+		PL_strcatn(resPath, sizeof(resPath), "/property");
 		i18nResource = res_init_resource(resPath, RESOURCE_FILE);
 	}
 	if (getenv("HTTP_ACCEPT_LANGUAGE")) {


Index: userinfo.c
===================================================================
RCS file: /cvs/dirsec/adminserver/admserv/cgi-src40/userinfo.c,v
retrieving revision 1.3
retrieving revision 1.4
diff -u -r1.3 -r1.4
--- userinfo.c	18 Aug 2005 18:59:03 -0000	1.3
+++ userinfo.c	31 Mar 2006 22:58:20 -0000	1.4
@@ -34,7 +34,6 @@
 {
   int            _ai = ADMUTIL_Init();
   AdmldapInfo    ldapInfo;
-  char           admconf[256];
   char           *method;
   int            rv, rv1, rv2;
   int            err;


Index: viewdata.c
===================================================================
RCS file: /cvs/dirsec/adminserver/admserv/cgi-src40/viewdata.c,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -r1.4 -r1.5
--- viewdata.c	18 Aug 2005 18:59:03 -0000	1.4
+++ viewdata.c	31 Mar 2006 22:58:20 -0000	1.5
@@ -95,8 +95,8 @@
 	char resPath[256], *execPath;
 	execPath = getcwd(resPath, 256);
 	if (execPath) {
-		strcpy(resPath, execPath);
-		strcat(resPath, "/property");
+		PL_strncpyz(resPath, execPath, sizeof(resPath));
+		PL_strcatn(resPath, sizeof(resPath), "/property");
 		i18nResource = res_init_resource(resPath, RESOURCE_FILE);
 	}
 	if (getenv("HTTP_ACCEPT_LANGUAGE")) {
@@ -222,6 +222,7 @@
   char *dn;
   char *domain;
   char *tmp, *tmp2;
+  char *base = NULL;
 
   LDAPMessage *entry;
   int ldapError;
@@ -243,39 +244,28 @@
 
   /* form the rest of the url */
 
-  if(strstr(sie, "Messaging")) {
-    dn = (char *)malloc(strlen("ou=Messaging, ou=Global Preferences, ") +
strlen(domain) + 1);
-    sprintf(dn, "ou=Messaging, ou=Global Preferences, %s", domain);
-  }
-  else if(strstr(sie, "Administration")) {
-    dn = (char *)malloc(strlen("ou=Admin, ou=Global Preferences, ") +
strlen(domain) + 1);
-    sprintf(dn, "ou=Admin, ou=Global Preferences, %s", domain);
+  if(strstr(sie, "Administration")) {
+    base = "ou=Admin, ou=Global Preferences";
   }
   else if(strstr(sie, "Directory")) {
-    dn = (char *)malloc(strlen("ou=Directory, ou=Global Preferences, ") +
strlen(domain) + 1);
-    sprintf(dn, "ou=Directory, ou=Global Preferences, %s", domain);
+    base = "ou=Directory, ou=Global Preferences";
   }
   else if(strstr(sie, "Enterprise")) {
-    dn = (char *)malloc(strlen("ou=Enterprise, ou=Global Preferences, ") +
strlen(domain) + 1);
-    sprintf(dn, "ou=Enterprise, ou=Global Preferences, %s", domain);
+    base = "ou=Enterprise, ou=Global Preferences";
   }
   else if(strstr(sie, "Certificate")) {
-    dn = (char *)malloc(strlen("ou=Certificate, ou=Global Preferences, ") +
strlen(domain) + 1);
-    sprintf(dn, "ou=Certificate, ou=Global Preferences, %s", domain);
-  }
-  else if(strstr(sie, "Application")) {
-    dn = (char *)malloc(strlen("ou=Application, ou=Global Preferences, ") +
strlen(domain) + 1);
-    sprintf(dn, "ou=Application, ou=Global Preferences, %s", domain);
-  }
-  else if(strstr(sie, "Biller")) {
-    dn = (char *)malloc(strlen("ou=Biller, ou=Global Preferences, ") +
strlen(domain) + 1);
-    sprintf(dn, "ou=Biller, ou=Global Preferences, %s", domain);
+    base = "ou=Certificate, ou=Global Preferences";
   }
 
+  dn = PR_smprintf("%s, %s", base, domain);
+
   if((ldapError = ldap_search_s(server, dn, LDAP_SCOPE_BASE,
-				"(objectclass=*)", NULL, 0, &entry)) != LDAP_SUCCESS)
+				"(objectclass=*)", NULL, 0, &entry)) != LDAP_SUCCESS) {
+    PR_smprintf_free(dn);
     return 1;
+  }
 
+  PR_smprintf_free(dn);
   if(vals = ldap_get_values(server, entry, "nshtmladminproducturl")) {
     *url = strdup(vals[0]);
     ldap_value_free(vals);
@@ -329,7 +319,7 @@
     tzset();
     PR_snprintf(buf, sizeof(buf), "%s %s", buf, daylight ? tzname[1] :
tzname[0]);
 #else
-    strftime(buf, BIG_LINE, "%b %d, %Y %T %p %Z", &tm);
+    strftime(buf, sizeof(buf), "%b %d, %Y %T %p %Z", &tm);
 #endif
 
 
@@ -346,15 +336,16 @@
   if(!(vals = ldap_get_values(server, entry, "nsserverport"))) {
     /* argh, port can be in the configuration object */
 
-    char *config_buf = (char *)malloc(strlen("cn=configuration, ") +
strlen(sie) + 1);
-    sprintf(config_buf, "cn=configuration, %s", sie);
+    char *config_buf = PR_smprintf("cn=configuration, %s", sie);
 				      
     if((ldapError = ldap_search_s(server, config_buf, LDAP_SCOPE_BASE,
-				  "(objectclass=*)", NULL, 0, &entry)) != LDAP_SUCCESS)
+				  "(objectclass=*)", NULL, 0, &entry)) != LDAP_SUCCESS) {
+      PR_smprintf_free(config_buf);
       return;
+    }
 
+    PR_smprintf_free(config_buf);
     vals = ldap_get_values(server, entry, "nsserverport");
-    free(config_buf);
   }
   if(vals) {
     fprintf(stdout, (const char*)getResourceString(DBT_OUTPUT_DATA_SERVER_PORT),
vals[0]);
@@ -499,15 +490,12 @@
 
 	      nbuf = (bufstruct *) new_buffer(NBUF_SIZE);
 
-	      request = (char *)malloc(strlen(getResourceString(DBT_NETCENTER_GET_REQ)) +
-				       strlen((char *)binddn) +
-				       3); /* space + 2 newline characters */
-
-	      sprintf(request, getResourceString(DBT_NETCENTER_GET_REQ), binddn);
+	      request = PR_smprintf(getResourceString(DBT_NETCENTER_GET_REQ), binddn);
 	      sockd = make_http_request("http", 
 					getResourceString(DBT_NETCENTER_HOST), 
 					atoi(getResourceString(DBT_NETCENTER_PORT)), 
 					request, 60, &errorcode);
+          PR_smprintf_free(request);
 
 	      if (sockd == NULL) {
 		continue;


Index: viewlog.c
===================================================================
RCS file: /cvs/dirsec/adminserver/admserv/cgi-src40/viewlog.c,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -r1.4 -r1.5
--- viewlog.c	18 Aug 2005 18:59:03 -0000	1.4
+++ viewlog.c	31 Mar 2006 22:58:20 -0000	1.5
@@ -86,7 +86,7 @@
 
   replace=0;
   count=0;
-  while(fgets(line, BIG_LINE, cmd)) {
+  while(fgets(line, sizeof(line), cmd)) {
     if(strncmp(line, "format=", 7)) 
       if((!str) || (strstr(line, str))) {
 	count++;
@@ -129,8 +129,8 @@
 	char resPath[256], *execPath;
 	execPath = getcwd(resPath, 256);
 	if (execPath) {
-		strcpy(resPath, execPath);
-		strcat(resPath, "/property");
+		PL_strncpyz(resPath, execPath, sizeof(resPath));
+		PL_strcatn(resPath, sizeof(resPath), "/property");
 		i18nResource = res_init_resource(resPath, RESOURCE_FILE);
 	}
 	if (getenv("HTTP_ACCEPT_LANGUAGE")) {
@@ -163,7 +163,7 @@
     }
     fprintf(stdout, getResourceString(DBT_DISPLAY_LOGFILE_SELECT_BEGIN));
 
-    strcpy(temp_dirs, dirs);
+    PL_strncpyz(temp_dirs, dirs, sizeof(temp_dirs));
     current_dir = strtok(temp_dirs, "|");
 
     while(current_dir) {
@@ -226,7 +226,7 @@
   if(!file)
     return NULL;
 
-  strcpy(temp, directories);
+  PL_strncpyz(temp, directories, sizeof(temp));
 
   ptr = strtok(temp, "|");
   while(ptr != NULL) {
@@ -374,7 +374,6 @@
     char *file;
     char *directories;
     char *id;
-    char log_dir[PATH_MAX];
     char **logfiles = NULL;
     char tmp[BIG_LINE];
     int x;