Fix: Use snprintf instead of sprintf in atmodem

12 files changed, 58 insertions, 55 deletions

diff --git a/drivers/atmodem/call-barring.c b/drivers/atmodem/call-barring.c
index 10f17fb0..28476bbb 100644
--- a/drivers/atmodem/call-barring.c
+++ b/drivers/atmodem/call-barring.c
@@ -90,7 +90,7 @@ static void at_call_barring_query(struct ofono_call_barring *cb,
 	if (!cbd || strlen(lock) != 2)
 		goto error;
 
-	sprintf(buf, "AT+CLCK=\"%s\",2", lock);
+	snprintf(buf, sizeof(buf), "AT+CLCK=\"%s\",2", lock);
 
 	if (g_at_chat_send(chat, buf, clck_prefix,
 				clck_query_cb, cbd, g_free) > 0)
diff --git a/drivers/atmodem/call-forwarding.c b/drivers/atmodem/call-forwarding.c
index d2d42d12..b210242f 100644
--- a/drivers/atmodem/call-forwarding.c
+++ b/drivers/atmodem/call-forwarding.c
@@ -135,9 +135,9 @@ static void at_ccfc_query(struct ofono_call_forwarding *cf, int type, int cls,
 	cbd->user = GINT_TO_POINTER(cls);
 
 	if (cls == 7)
-		sprintf(buf, "AT+CCFC=%d,2", type);
+		snprintf(buf, sizeof(buf), "AT+CCFC=%d,2", type);
 	else
-		sprintf(buf, "AT+CCFC=%d,2,,,%d", type, cls);
+		snprintf(buf, sizeof(buf), "AT+CCFC=%d,2,,,%d", type, cls);
 
 	if (g_at_chat_send(chat, buf, ccfc_prefix,
 				ccfc_query_cb, cbd, g_free) > 0)
@@ -189,10 +189,10 @@ static void at_ccfc_erasure(struct ofono_call_forwarding *cf,
 	char buf[128];
 	int len;
 
-	len = sprintf(buf, "AT+CCFC=%d,4", type);
+	len = snprintf(buf, sizeof(buf), "AT+CCFC=%d,4", type);
 
 	if (cls != 7)
-		sprintf(buf + len, ",,,%d", cls);
+		snprintf(buf + len, sizeof(buf) - len, ",,,%d", cls);
 
 	at_ccfc_set(cf, buf, cb, data);
 }
@@ -205,10 +205,10 @@ static void at_ccfc_deactivation(struct ofono_call_forwarding *cf,
 	char buf[128];
 	int len;
 
-	len = sprintf(buf, "AT+CCFC=%d,0", type);
+	len = snprintf(buf, sizeof(buf), "AT+CCFC=%d,0", type);
 
 	if (cls != 7)
-		sprintf(buf + len, ",,,%d", cls);
+		snprintf(buf + len, sizeof(buf) - len, ",,,%d", cls);
 
 	at_ccfc_set(cf, buf, cb, data);
 }
@@ -220,10 +220,10 @@ static void at_ccfc_activation(struct ofono_call_forwarding *cf,
 	char buf[128];
 	int len;
 
-	len = sprintf(buf, "AT+CCFC=%d,1", type);
+	len = snprintf(buf, sizeof(buf), "AT+CCFC=%d,1", type);
 
 	if (cls != 7)
-		sprintf(buf + len, ",,,%d", cls);
+		snprintf(buf + len, sizeof(buf) - len, ",,,%d", cls);
 
 	at_ccfc_set(cf, buf, cb, data);
 }
@@ -238,11 +238,11 @@ static void at_ccfc_registration(struct ofono_call_forwarding *cf,
 	char buf[128];
 	int offset;
 
-	offset = sprintf(buf, "AT+CCFC=%d,3,\"%s\",%d,%d", type,
+	offset = snprintf(buf, sizeof(buf), "AT+CCFC=%d,3,\"%s\",%d,%d", type,
 				ph->number, ph->type, cls);
 
 	if (type == 2 || type == 4 || type == 5)
-		sprintf(buf+offset, ",,,%d", time);
+		snprintf(buf+offset, sizeof(buf) - offset, ",,,%d", time);
 
 	at_ccfc_set(cf, buf, cb, data);
 }
diff --git a/drivers/atmodem/call-meter.c b/drivers/atmodem/call-meter.c
index 3cff8de0..7c40f50c 100644
--- a/drivers/atmodem/call-meter.c
+++ b/drivers/atmodem/call-meter.c
@@ -218,7 +218,7 @@ static void at_camm_set(struct ofono_call_meter *cm,
 	if (!cbd)
 		goto error;
 
-	sprintf(buf, "AT+CAMM=\"%06X\",\"%s\"", accmax, passwd);
+	snprintf(buf, sizeof(buf), "AT+CAMM=\"%06X\",\"%s\"", accmax, passwd);
 
 	if (g_at_chat_send(chat, buf, none_prefix,
 				generic_set_cb, cbd, g_free) > 0)
diff --git a/drivers/atmodem/call-settings.c b/drivers/atmodem/call-settings.c
index cc0c7d0c..7ec69d39 100644
--- a/drivers/atmodem/call-settings.c
+++ b/drivers/atmodem/call-settings.c
@@ -90,9 +90,9 @@ static void at_ccwa_query(struct ofono_call_settings *cs, int cls,
 	cbd->user = GINT_TO_POINTER(cls);
 
 	if (cls == 7)
-		sprintf(buf, "AT+CCWA=1,2");
+		snprintf(buf, sizeof(buf), "AT+CCWA=1,2");
 	else
-		sprintf(buf, "AT+CCWA=1,2,%d", cls);
+		snprintf(buf, sizeof(buf), "AT+CCWA=1,2,%d", cls);
 
 	if (g_at_chat_send(chat, buf, ccwa_prefix,
 				ccwa_query_cb, cbd, g_free) > 0)
@@ -127,7 +127,7 @@ static void at_ccwa_set(struct ofono_call_settings *cs, int mode, int cls,
 	if (!cbd)
 		goto error;
 
-	sprintf(buf, "AT+CCWA=1,%d,%d", mode, cls);
+	snprintf(buf, sizeof(buf), "AT+CCWA=1,%d,%d", mode, cls);
 
 	if (g_at_chat_send(chat, buf, none_prefix,
 				ccwa_set_cb, cbd, g_free) > 0)
@@ -319,7 +319,7 @@ static void at_clir_set(struct ofono_call_settings *cs, int mode,
 	if (!cbd)
 		goto error;
 
-	sprintf(buf, "AT+CLIR=%d", mode);
+	snprintf(buf, sizeof(buf), "AT+CLIR=%d", mode);
 
 	if (g_at_chat_send(chat, buf, none_prefix,
 				clir_set_cb, cbd, g_free) > 0)
diff --git a/drivers/atmodem/cbs.c b/drivers/atmodem/cbs.c
index 39f019bb..adc52b52 100644
--- a/drivers/atmodem/cbs.c
+++ b/drivers/atmodem/cbs.c
@@ -144,9 +144,9 @@ static void at_cbs_clear_topics(struct ofono_cbs *cbs,
 		goto error;
 
 	if (data->cscb_mode_1)
-		sprintf(buf, "AT+CSCB=1,\"0-65535\"");
+		snprintf(buf, sizeof(buf), "AT+CSCB=1,\"0-65535\"");
 	else
-		sprintf(buf, "AT+CSCB=0,\"\"");
+		snprintf(buf, sizeof(buf), "AT+CSCB=0,\"\"");
 
 	if (g_at_chat_send(data->chat, buf, none_prefix,
 				at_cscb_set_cb, cbd, g_free) > 0)
@@ -209,9 +209,9 @@ static void at_cscb_support_cb(gboolean ok, GAtResult *result, gpointer user)
 	 * of new topics using CSCB mode 0.
 	 */
 	if (data->cscb_mode_1)
-		sprintf(buf, "AT+CSCB=1,\"0-65535\"");
+		snprintf(buf, sizeof(buf), "AT+CSCB=1,\"0-65535\"");
 	else
-		sprintf(buf, "AT+CSCB=0,\"\"");
+		snprintf(buf, sizeof(buf), "AT+CSCB=0,\"\"");
 
 	if (g_at_chat_send(data->chat, buf, none_prefix,
 				at_cbs_register, cbs, NULL) > 0)
diff --git a/drivers/atmodem/gprs-context.c b/drivers/atmodem/gprs-context.c
index 445b9905..5a09e2aa 100644
--- a/drivers/atmodem/gprs-context.c
+++ b/drivers/atmodem/gprs-context.c
@@ -99,7 +99,7 @@ static void at_cgdcont_cb(gboolean ok, GAtResult *result, gpointer user_data)
 
 	ncbd = g_memdup(cbd, sizeof(struct cb_data));
 
-	sprintf(buf, "AT+CGACT=1,%u", gcd->active_context);
+	snprintf(buf, sizeof(buf), "AT+CGACT=1,%u", gcd->active_context);
 
 	if (g_at_chat_send(gcd->chat, buf, none_prefix,
 				at_cgact_up_cb, ncbd, g_free) > 0)
@@ -130,7 +130,7 @@ static void at_gprs_activate_primary(struct ofono_gprs_context *gc,
 	cbd->user = gc;
 
 	/* TODO: Handle username / password fields */
-	len = sprintf(buf, "AT+CGDCONT=%u,\"IP\"", ctx->cid);
+	len = snprintf(buf, sizeof(buf), "AT+CGDCONT=%u,\"IP\"", ctx->cid);
 
 	if (ctx->apn)
 		snprintf(buf + len, sizeof(buf) - len - 3, ",\"%s\"",
@@ -159,7 +159,7 @@ static void at_gprs_deactivate_primary(struct ofono_gprs_context *gc,
 
 	cbd->user = gc;
 
-	sprintf(buf, "AT+CGACT=0,%u", id);
+	snprintf(buf, sizeof(buf), "AT+CGACT=0,%u", id);
 
 	if (g_at_chat_send(gcd->chat, buf, none_prefix,
 				at_cgact_down_cb, cbd, g_free) > 0)
diff --git a/drivers/atmodem/gprs.c b/drivers/atmodem/gprs.c
index 9a8826a3..a51fdef3 100644
--- a/drivers/atmodem/gprs.c
+++ b/drivers/atmodem/gprs.c
@@ -72,7 +72,7 @@ static void at_gprs_set_attached(struct ofono_gprs *gprs, int attached,
 	if (!cbd)
 		goto error;
 
-	sprintf(buf, "AT+CGATT=%i", attached ? 1 : 0);
+	snprintf(buf, sizeof(buf), "AT+CGATT=%i", attached ? 1 : 0);
 
 	if (g_at_chat_send(gd->chat, buf, none_prefix,
 				at_cgatt_cb, cbd, g_free) > 0)
diff --git a/drivers/atmodem/network-registration.c b/drivers/atmodem/network-registration.c
index c6489b56..e8bdd770 100644
--- a/drivers/atmodem/network-registration.c
+++ b/drivers/atmodem/network-registration.c
@@ -423,7 +423,7 @@ static void at_register_manual(struct ofono_netreg *netreg,
 	if (!cbd)
 		goto error;
 
-	sprintf(buf, "AT+COPS=1,2,\"%s%s\"", mcc, mnc);
+	snprintf(buf, sizeof(buf), "AT+COPS=1,2,\"%s%s\"", mcc, mnc);
 
 	if (g_at_chat_send(nd->chat, buf, none_prefix,
 				register_cb, cbd, g_free) > 0)
diff --git a/drivers/atmodem/phonebook.c b/drivers/atmodem/phonebook.c
index 6c97df3c..52126f42 100644
--- a/drivers/atmodem/phonebook.c
+++ b/drivers/atmodem/phonebook.c
@@ -232,7 +232,7 @@ static void at_read_entries_cb(gboolean ok, GAtResult *result,
 	charset = best_charset(pbd->supported);
 
 	if (strcmp(pbd->old_charset, charset)) {
-		sprintf(buf, "AT+CSCS=\"%s\"", pbd->old_charset);
+		snprintf(buf, sizeof(buf), "AT+CSCS=\"%s\"", pbd->old_charset);
 		g_at_chat_send(pbd->chat, buf, none_prefix, NULL, NULL, NULL);
 	}
 
@@ -246,7 +246,8 @@ static void at_read_entries(struct cb_data *cbd)
 	struct pb_data *pbd = ofono_phonebook_get_data(pb);
 	char buf[32];
 
-	sprintf(buf, "AT+CPBR=%d,%d", pbd->index_min, pbd->index_max);
+	snprintf(buf, sizeof(buf), "AT+CPBR=%d,%d",
+			pbd->index_min, pbd->index_max);
 	if (g_at_chat_send_listing(pbd->chat, buf, cpbr_prefix,
 					at_cpbr_notify, at_read_entries_cb,
 					cbd, NULL) > 0)
@@ -302,7 +303,7 @@ static void at_read_charset_cb(gboolean ok, GAtResult *result,
 		return;
 	}
 
-	sprintf(buf, "AT+CSCS=\"%s\"", charset);
+	snprintf(buf, sizeof(buf), "AT+CSCS=\"%s\"", charset);
 	if (g_at_chat_send(pbd->chat, buf, none_prefix,
 				at_set_charset_cb, cbd, NULL) > 0)
 		return;
@@ -379,7 +380,7 @@ static void at_export_entries(struct ofono_phonebook *pb, const char *storage,
 
 	cbd->user = pb;
 
-	sprintf(buf, "AT+CPBS=\"%s\"", storage);
+	snprintf(buf, sizeof(buf), "AT+CPBS=\"%s\"", storage);
 	if (g_at_chat_send(pbd->chat, buf, none_prefix,
 				at_select_storage_cb, cbd, NULL) > 0)
 		return;
diff --git a/drivers/atmodem/sms.c b/drivers/atmodem/sms.c
index 33ae57d0..0b8b902f 100644
--- a/drivers/atmodem/sms.c
+++ b/drivers/atmodem/sms.c
@@ -108,7 +108,7 @@ static void at_csca_set(struct ofono_sms *sms,
 	if (!cbd)
 		goto error;
 
-	sprintf(buf, "AT+CSCA=\"%s\",%d", sca->number, sca->type);
+	snprintf(buf, sizeof(buf), "AT+CSCA=\"%s\",%d", sca->number, sca->type);
 
 	if (g_at_chat_send(data->chat, buf, csca_prefix,
 				at_csca_set_cb, cbd, g_free) > 0)
@@ -234,12 +234,12 @@ static void at_cmgs(struct ofono_sms *sms, unsigned char *pdu, int pdu_len,
 		goto error;
 
 	if (mms) {
-		sprintf(buf, "AT+CMMS=%d", mms);
+		snprintf(buf, sizeof(buf), "AT+CMMS=%d", mms);
 		g_at_chat_send(data->chat, buf, none_prefix,
 				NULL, NULL, NULL);
 	}
 
-	len = sprintf(buf, "AT+CMGS=%d\r", tpdu_len);
+	len = snprintf(buf, sizeof(buf), "AT+CMGS=%d\r", tpdu_len);
 	encode_hex_own_buf(pdu, pdu_len, 0, buf+len);
 
 	if (g_at_chat_send(data->chat, buf, cmgs_prefix,
@@ -300,10 +300,10 @@ static void at_cds_notify(GAtResult *result, gpointer user_data)
 
 	/* We must acknowledge the PDU using CNMA */
 	if (data->cnma_ack_pdu)
-		sprintf(buf, "AT+CNMA=1,%d\r%s", data->cnma_ack_pdu_len,
-				data->cnma_ack_pdu);
-	else
-		sprintf(buf, "AT+CNMA=0"); /* Should be a safe fallback */
+		snprintf(buf, sizeof(buf), "AT+CNMA=1,%d\r%s",
+				data->cnma_ack_pdu_len, data->cnma_ack_pdu);
+	else /* Should be a safe fallback */
+		snprintf(buf, sizeof(buf), "AT+CNMA=0");
 
 	g_at_chat_send(data->chat, buf, none_prefix, at_cnma_cb, NULL, NULL);
 }
@@ -338,10 +338,10 @@ static void at_cmt_notify(GAtResult *result, gpointer user_data)
 
 	/* We must acknowledge the PDU using CNMA */
 	if (data->cnma_ack_pdu)
-		sprintf(buf, "AT+CNMA=1,%d\r%s", data->cnma_ack_pdu_len,
-				data->cnma_ack_pdu);
-	else
-		sprintf(buf, "AT+CNMA=0"); /* Should be a safe fallback */
+		snprintf(buf, sizeof(buf), "AT+CNMA=1,%d\r%s",
+				data->cnma_ack_pdu_len, data->cnma_ack_pdu);
+	else /* Should be a safe fallback */
+		snprintf(buf, sizeof(buf), "AT+CNMA=0");
 
 	g_at_chat_send(data->chat, buf, none_prefix, at_cnma_cb, NULL, NULL);
 }
@@ -412,11 +412,11 @@ static void at_cmti_cpms_cb(gboolean ok, GAtResult *result, gpointer user_data)
 
 	data->store = req->store;
 
-	sprintf(buf, "AT+CMGR=%d", req->index);
+	snprintf(buf, sizeof(buf), "AT+CMGR=%d", req->index);
 	g_at_chat_send(data->chat, buf, none_prefix, at_cmgr_cb, NULL, NULL);
 
 	/* We don't buffer SMS on the SIM/ME, send along a CMGD as well */
-	sprintf(buf, "AT+CMGD=%d", req->index);
+	snprintf(buf, sizeof(buf), "AT+CMGD=%d", req->index);
 	g_at_chat_send(data->chat, buf, none_prefix, at_cmgd_cb, NULL, NULL);
 }
 
@@ -468,8 +468,8 @@ static void at_cmti_notify(GAtResult *result, gpointer user_data)
 		req->store = store;
 		req->index = index;
 
-		sprintf(buf, "AT+CPMS=\"%s\",\"%s\",\"%s\"",
-			strstore, strstore, incoming);
+		snprintf(buf, sizeof(buf), "AT+CPMS=\"%s\",\"%s\",\"%s\"",
+				strstore, strstore, incoming);
 
 		g_at_chat_send(data->chat, buf, cpms_prefix, at_cmti_cpms_cb,
 				req, g_free);
@@ -535,7 +535,7 @@ static void at_cmgl_notify(GAtResult *result, gpointer user_data)
 		ofono_sms_deliver_notify(sms, pdu, pdu_len, tpdu_len);
 
 		/* We don't buffer SMS on the SIM/ME, send along a CMGD */
-		sprintf(buf, "AT+CMGD=%d", index);
+		snprintf(buf, sizeof(buf), "AT+CMGD=%d", index);
 		g_at_chat_send(data->chat, buf, none_prefix,
 				at_cmgd_cb, NULL, NULL);
 	}
@@ -593,8 +593,8 @@ static void at_cmgl_set_cpms(struct ofono_sms *sms, int store)
 		req->sms = sms;
 		req->store = store;
 
-		sprintf(buf, "AT+CPMS=\"%s\",\"%s\",\"%s\"",
-			readwrite, readwrite, incoming);
+		snprintf(buf, sizeof(buf), "AT+CPMS=\"%s\",\"%s\",\"%s\"",
+				readwrite, readwrite, incoming);
 
 		g_at_chat_send(data->chat, buf, cpms_prefix, at_cmgl_cpms_cb,
 				req, g_free);
@@ -831,7 +831,8 @@ static gboolean set_cpms(gpointer user_data)
 	const char *incoming = storages[data->incoming];
 	char buf[128];
 
-	sprintf(buf, "AT+CPMS=\"%s\",\"%s\",\"%s\"", store, store, incoming);
+	snprintf(buf, sizeof(buf), "AT+CPMS=\"%s\",\"%s\",\"%s\"",
+			store, store, incoming);
 
 	g_at_chat_send(data->chat, buf, cpms_prefix,
 			at_cpms_set_cb, sms, NULL);
@@ -1067,7 +1068,7 @@ static void at_csms_query_cb(gboolean ok, GAtResult *result,
 	ofono_debug("CSMS query parsed successfully");
 
 out:
-	sprintf(buf, "AT+CSMS=%d", cnma_supported ? 1 : 0);
+	snprintf(buf, sizeof(buf), "AT+CSMS=%d", cnma_supported ? 1 : 0);
 	g_at_chat_send(data->chat, buf, csms_prefix,
 			at_csms_set_cb, sms, NULL);
 }
diff --git a/drivers/atmodem/ussd.c b/drivers/atmodem/ussd.c
index e4b19ee0..6a399100 100644
--- a/drivers/atmodem/ussd.c
+++ b/drivers/atmodem/ussd.c
@@ -147,7 +147,8 @@ static void at_ussd_request(struct ofono_ussd *ussd, const char *str,
 	if (written > max_len)
 		goto error;
 
-	sprintf(buf, "AT+CUSD=1,\"%.*s\",%d", (int) written, converted, dcs);
+	snprintf(buf, sizeof(buf), "AT+CUSD=1,\"%.*s\",%d",
+			(int) written, converted, dcs);
 
 	g_free(converted);
 	converted = NULL;
diff --git a/drivers/atmodem/voicecall.c b/drivers/atmodem/voicecall.c
index 903b2dd2..efee9cdc 100644
--- a/drivers/atmodem/voicecall.c
+++ b/drivers/atmodem/voicecall.c
@@ -344,9 +344,9 @@ static void at_dial(struct ofono_voicecall *vc,
 	cbd->user = vc;
 
 	if (ph->type == 145)
-		sprintf(buf, "ATD+%s", ph->number);
+		snprintf(buf, sizeof(buf), "ATD+%s", ph->number);
 	else
-		sprintf(buf, "ATD%s", ph->number);
+		snprintf(buf, sizeof(buf), "ATD%s", ph->number);
 
 	switch (clir) {
 	case OFONO_CLIR_OPTION_INVOCATION:
@@ -476,7 +476,7 @@ static void at_release_specific(struct ofono_voicecall *vc, int id,
 	req->data = data;
 	req->id = id;
 
-	sprintf(buf, "AT+CHLD=1%d", id);
+	snprintf(buf, sizeof(buf), "AT+CHLD=1%d", id);
 
 	if (g_at_chat_send(vd->chat, buf, none_prefix,
 				release_id_cb, req, g_free) > 0)
@@ -494,7 +494,7 @@ static void at_private_chat(struct ofono_voicecall *vc, int id,
 {
 	char buf[32];
 
-	sprintf(buf, "AT+CHLD=2%d", id);
+	snprintf(buf, sizeof(buf), "AT+CHLD=2%d", id);
 	at_template(buf, vc, generic_cb, 0, cb, data);
 }
 
@@ -526,7 +526,7 @@ static void at_deflect(struct ofono_voicecall *vc,
 	char buf[128];
 	unsigned int incoming_or_waiting = (0x1 << 4) | (0x1 << 5);
 
-	sprintf(buf, "AT+CTFR=%s,%d", ph->number, ph->type);
+	snprintf(buf, sizeof(buf), "AT+CTFR=%s,%d", ph->number, ph->type);
 	at_template(buf, vc, generic_cb, incoming_or_waiting, cb, data);
 }