1 |
pva 08/09/10 06:57:40 |
2 |
|
3 |
Added: wordnet-3.0-CVE-2008-3908.patch |
4 |
Removed: Wordnet-2.1-compile-fix-new.patch |
5 |
Wordnet-2.1-dict-location.patch Makefiles.diff |
6 |
Log: |
7 |
Appling fix for security issue, bug #211491, thank Jukka Ruohonen for report and Robert Buchholz for pointing to patch. Remove old. |
8 |
(Portage version: 2.2_rc8/cvs/Linux 2.6.25-gentoo-r7 i686) |
9 |
|
10 |
Revision Changes Path |
11 |
1.1 app-dicts/wordnet/files/wordnet-3.0-CVE-2008-3908.patch |
12 |
|
13 |
file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/app-dicts/wordnet/files/wordnet-3.0-CVE-2008-3908.patch?rev=1.1&view=markup |
14 |
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/app-dicts/wordnet/files/wordnet-3.0-CVE-2008-3908.patch?rev=1.1&content-type=text/plain |
15 |
|
16 |
Index: wordnet-3.0-CVE-2008-3908.patch |
17 |
=================================================================== |
18 |
diff --git a/lib/binsrch.c b/lib/binsrch.c |
19 |
index 85436f3..8b71216 100644 |
20 |
--- a/lib/binsrch.c |
21 |
+++ b/lib/binsrch.c |
22 |
@@ -28,7 +28,7 @@ char *read_index(long offset, FILE *fp) { |
23 |
char *linep; |
24 |
|
25 |
linep = line; |
26 |
- line[0] = '0'; |
27 |
+ line[0] = '\0'; |
28 |
|
29 |
fseek( fp, offset, SEEK_SET ); |
30 |
fgets(linep, LINE_LEN, fp); |
31 |
@@ -58,6 +58,8 @@ char *bin_search(char *searchkey, FILE *fp) |
32 |
last_bin_search_offset = ftell( fp ); |
33 |
fgets(linep, LINE_LEN, fp); |
34 |
length = (int)(strchr(linep, ' ') - linep); |
35 |
+ if (length > (sizeof(key) - 1)) |
36 |
+ return(NULL); |
37 |
strncpy(key, linep, length); |
38 |
key[length] = '\0'; |
39 |
if(strcmp(key, searchkey) < 0) { |
40 |
@@ -110,6 +112,8 @@ static int bin_search_key(char *searchkey, FILE *fp) |
41 |
line[length++] = c; |
42 |
if (getc(fp) == EOF) { /* only 1 line in file */ |
43 |
length = (int)(strchr(linep, ' ') - linep); |
44 |
+ if (length > (sizeof(key) - 1)) |
45 |
+ return(0); |
46 |
strncpy(key, linep, length); |
47 |
key[length] = '\0'; |
48 |
if(strcmp(key, searchkey) > 0) { |
49 |
@@ -132,6 +136,8 @@ static int bin_search_key(char *searchkey, FILE *fp) |
50 |
if (fgets(linep, LINE_LEN, fp) != NULL) { |
51 |
offset2 = ftell(fp); /* offset at start of next line */ |
52 |
length = (int)(strchr(linep, ' ') - linep); |
53 |
+ if (length > (sizeof(key) - 1)) |
54 |
+ return(0); |
55 |
strncpy(key, linep, length); |
56 |
key[length] = '\0'; |
57 |
if(strcmp(key, searchkey) < 0) { /* further in file */ |
58 |
diff --git a/lib/morph.c b/lib/morph.c |
59 |
index 0cff594..ea4b4f8 100644 |
60 |
--- a/lib/morph.c |
61 |
+++ b/lib/morph.c |
62 |
@@ -51,24 +51,24 @@ static struct { |
63 |
char *str; |
64 |
int strlen; |
65 |
} prepositions[NUMPREPS] = { |
66 |
- "to", 2, |
67 |
- "at", 2, |
68 |
- "of", 2, |
69 |
- "on", 2, |
70 |
- "off", 3, |
71 |
- "in", 2, |
72 |
- "out", 3, |
73 |
- "up", 2, |
74 |
- "down", 4, |
75 |
- "from", 4, |
76 |
- "with", 4, |
77 |
- "into", 4, |
78 |
- "for", 3, |
79 |
- "about", 5, |
80 |
- "between", 7, |
81 |
+ { "to", 2 }, |
82 |
+ { "at", 2 }, |
83 |
+ { "of", 2 }, |
84 |
+ { "on", 2 }, |
85 |
+ { "off", 3 }, |
86 |
+ { "in", 2 }, |
87 |
+ { "out", 3 }, |
88 |
+ { "up", 2 }, |
89 |
+ { "down", 4 }, |
90 |
+ { "from", 4 }, |
91 |
+ { "with", 4 }, |
92 |
+ { "into", 4 }, |
93 |
+ { "for", 3 }, |
94 |
+ { "about", 5 }, |
95 |
+ { "between", 7 } |
96 |
}; |
97 |
|
98 |
-static FILE *exc_fps[NUMPARTS + 1]; |
99 |
+static FILE *exc_fps[NUMPARTS]; |
100 |
|
101 |
static int do_init(); |
102 |
static int strend(char *, char *); |
103 |
@@ -100,7 +100,7 @@ int re_morphinit(void) |
104 |
{ |
105 |
int i; |
106 |
|
107 |
- for (i = 1; i <= NUMPARTS; i++) { |
108 |
+ for (i = 0; i < NUMPARTS; i++) { |
109 |
if (exc_fps[i] != NULL) { |
110 |
fclose(exc_fps[i]); exc_fps[i] = NULL; |
111 |
} |
112 |
@@ -144,18 +144,19 @@ static int do_init(void) |
113 |
} else |
114 |
sprintf(searchdir, DEFAULTPATH); |
115 |
#else |
116 |
- if ((env = getenv("WNSEARCHDIR")) != NULL) |
117 |
- strcpy(searchdir, env); |
118 |
- else if ((env = getenv("WNHOME")) != NULL) |
119 |
- sprintf(searchdir, "%s%s", env, DICTDIR); |
120 |
- else |
121 |
+ if ((env = getenv("WNSEARCHDIR")) != NULL) { |
122 |
+ snprintf(searchdir, sizeof(searchdir), "%s", env); |
123 |
+ } else if ((env = getenv("WNHOME")) != NULL) { |
124 |
+ snprintf(searchdir, sizeof(searchdir), "%s%s", env, DICTDIR); |
125 |
+ } else { |
126 |
strcpy(searchdir, DEFAULTPATH); |
127 |
+ } |
128 |
#endif |
129 |
|
130 |
- for (i = 1; i <= NUMPARTS; i++) { |
131 |
- sprintf(fname, EXCFILE, searchdir, partnames[i]); |
132 |
+ for (i = 0; i < NUMPARTS; i++) { |
133 |
+ snprintf(fname, sizeof(fname), EXCFILE, searchdir, partnames[i+1]); |
134 |
if ((exc_fps[i] = fopen(fname, "r")) == NULL) { |
135 |
- sprintf(msgbuf, |
136 |
+ snprintf(msgbuf, sizeof(msgbuf), |
137 |
"WordNet library error: Can't open exception file(%s)\n\n", |
138 |
fname); |
139 |
display_message(msgbuf); |
140 |
@@ -178,13 +179,16 @@ char *morphstr(char *origstr, int pos) |
141 |
int prep; |
142 |
char *end_idx1, *end_idx2; |
143 |
char *append; |
144 |
- |
145 |
+ |
146 |
if (pos == SATELLITE) |
147 |
pos = ADJ; |
148 |
|
149 |
/* First time through for this string */ |
150 |
|
151 |
if (origstr != NULL) { |
152 |
+ if (strlen(origstr) > WORDBUF - 1) |
153 |
+ return(NULL); |
154 |
+ |
155 |
/* Assume string hasn't had spaces substitued with '_' */ |
156 |
strtolower(strsubst(strcpy(str, origstr), ' ', '_')); |
157 |
searchstr[0] = '\0'; |
158 |
@@ -232,7 +236,7 @@ char *morphstr(char *origstr, int pos) |
159 |
if (end_idx < 0) return(NULL); /* shouldn't do this */ |
160 |
strncpy(word, str + st_idx, end_idx - st_idx); |
161 |
word[end_idx - st_idx] = '\0'; |
162 |
- if(tmp = morphword(word, pos)) |
163 |
+ if ((tmp = morphword(word, pos)) != NULL) |
164 |
strcat(searchstr,tmp); |
165 |
else |
166 |
strcat(searchstr,word); |
167 |
@@ -240,7 +244,7 @@ char *morphstr(char *origstr, int pos) |
168 |
st_idx = end_idx + 1; |
169 |
} |
170 |
|
171 |
- if(tmp = morphword(strcpy(word, str + st_idx), pos)) |
172 |
+ if ((tmp = morphword(strcpy(word, str + st_idx), pos)) != NULL) |
173 |
strcat(searchstr,tmp); |
174 |
else |
175 |
strcat(searchstr,word); |
176 |
@@ -270,16 +274,15 @@ char *morphword(char *word, int pos) |
177 |
{ |
178 |
int offset, cnt; |
179 |
int i; |
180 |
- static char retval[WORDBUF]; |
181 |
- char *tmp, tmpbuf[WORDBUF], *end; |
182 |
- |
183 |
- sprintf(retval,""); |
184 |
- sprintf(tmpbuf, ""); |
185 |
- end = ""; |
186 |
- |
187 |
+ static char retval[WORDBUF] = ""; |
188 |
+ char *tmp, tmpbuf[WORDBUF] = "", *end = ""; |
189 |
+ |
190 |
if(word == NULL) |
191 |
return(NULL); |
192 |
|
193 |
+ if (strlen(word) > WORDBUF - 1) |
194 |
+ return(NULL); |
195 |
+ |
196 |
/* first look for word on exception list */ |
197 |
|
198 |
if((tmp = exc_lookup(word, pos)) != NULL) |
199 |
@@ -335,7 +338,10 @@ static char *wordbase(char *word, int ender) |
200 |
{ |
201 |
char *pt1; |
202 |
static char copy[WORDBUF]; |
203 |
- |
204 |
+ |
205 |
+ if (strlen(word) > WORDBUF - 1) |
206 |
+ return(NULL); |
207 |
+ |
208 |
strcpy(copy, word); |
209 |
if(strend(copy,sufx[ender])) { |
210 |
pt1=strchr(copy,'\0'); |
211 |
@@ -368,13 +374,14 @@ static char *exc_lookup(char *word, int pos) |
212 |
{ |
213 |
static char line[WORDBUF], *beglp, *endlp; |
214 |
char *excline; |
215 |
- int found = 0; |
216 |
|
217 |
if (exc_fps[pos] == NULL) |
218 |
return(NULL); |
219 |
|
220 |
/* first time through load line from exception file */ |
221 |
if(word != NULL){ |
222 |
+ if (strlen(word) > WORDBUF - 1) |
223 |
+ return(NULL); |
224 |
if ((excline = bin_search(word, exc_fps[pos])) != NULL) { |
225 |
strcpy(line, excline); |
226 |
endlp = strchr(line,' '); |
227 |
@@ -403,6 +410,9 @@ static char *morphprep(char *s) |
228 |
char word[WORDBUF], end[WORDBUF]; |
229 |
static char retval[WORDBUF]; |
230 |
|
231 |
+ if (strlen(s) > WORDBUF - 1) |
232 |
+ return (NULL); |
233 |
+ |
234 |
/* Assume that the verb is the first word in the phrase. Strip it |
235 |
off, check for validity, then try various morphs with the |
236 |
rest of the phrase tacked on, trying to find a match. */ |
237 |
@@ -410,7 +420,7 @@ static char *morphprep(char *s) |
238 |
rest = strchr(s, '_'); |
239 |
last = strrchr(s, '_'); |
240 |
if (rest != last) { /* more than 2 words */ |
241 |
- if (lastwd = morphword(last + 1, NOUN)) { |
242 |
+ if ((lastwd = morphword(last + 1, NOUN)) != NULL) { |
243 |
strncpy(end, rest, last - rest + 1); |
244 |
end[last-rest+1] = '\0'; |
245 |
strcat(end, lastwd); |
246 |
diff --git a/lib/search.c b/lib/search.c |
247 |
index 1cdedc3..bc781cd 100644 |
248 |
--- a/lib/search.c |
249 |
+++ b/lib/search.c |
250 |
@@ -13,6 +13,7 @@ |
251 |
#include <stdlib.h> |
252 |
#include <string.h> |
253 |
#include <assert.h> |
254 |
+#include <limits.h> |
255 |
|
256 |
#include "wn.h" |
257 |
|
258 |
@@ -119,33 +120,22 @@ IndexPtr parse_index(long offset, int dbase, char *line) { |
259 |
if ( !line ) |
260 |
line = read_index( offset, indexfps[dbase] ); |
261 |
|
262 |
- idx = (IndexPtr)malloc(sizeof(Index)); |
263 |
+ idx = (IndexPtr)calloc(1, sizeof(Index)); |
264 |
assert(idx); |
265 |
|
266 |
/* set offset of entry in index file */ |
267 |
idx->idxoffset = offset; |
268 |
|
269 |
- idx->wd='\0'; |
270 |
- idx->pos='\0'; |
271 |
- idx->off_cnt=0; |
272 |
- idx->tagged_cnt = 0; |
273 |
- idx->sense_cnt=0; |
274 |
- idx->offset='\0'; |
275 |
- idx->ptruse_cnt=0; |
276 |
- idx->ptruse='\0'; |
277 |
- |
278 |
/* get the word */ |
279 |
ptrtok=strtok(line," \n"); |
280 |
|
281 |
- idx->wd = malloc(strlen(ptrtok) + 1); |
282 |
+ idx->wd = strdup(ptrtok); |
283 |
assert(idx->wd); |
284 |
- strcpy(idx->wd, ptrtok); |
285 |
|
286 |
/* get the part of speech */ |
287 |
ptrtok=strtok(NULL," \n"); |
288 |
- idx->pos = malloc(strlen(ptrtok) + 1); |
289 |
+ idx->pos = strdup(ptrtok); |
290 |
assert(idx->pos); |
291 |
- strcpy(idx->pos, ptrtok); |
292 |
|
293 |
/* get the collins count */ |
294 |
ptrtok=strtok(NULL," \n"); |
295 |
@@ -154,7 +144,12 @@ IndexPtr parse_index(long offset, int dbase, char *line) { |
296 |
/* get the number of pointers types */ |
297 |
ptrtok=strtok(NULL," \n"); |
298 |
idx->ptruse_cnt = atoi(ptrtok); |
299 |
- |
300 |
+ |
301 |
+ if (idx->ptruse_cnt < 0 || (unsigned int)idx->ptruse_cnt > UINT_MAX/sizeof(int)) { |
302 |
+ free_index(idx); |
303 |
+ return(NULL); |
304 |
+ } |
305 |
+ |
306 |
if (idx->ptruse_cnt) { |
307 |
idx->ptruse = (int *) malloc(idx->ptruse_cnt * (sizeof(int))); |
308 |
assert(idx->ptruse); |
309 |
@@ -173,9 +168,14 @@ IndexPtr parse_index(long offset, int dbase, char *line) { |
310 |
/* get the number of senses that are tagged */ |
311 |
ptrtok=strtok(NULL," \n"); |
312 |
idx->tagged_cnt = atoi(ptrtok); |
313 |
- |
314 |
+ |
315 |
+ if (idx->off_cnt < 0 || (unsigned long)idx->off_cnt > ULONG_MAX/sizeof(long)) { |
316 |
+ free_index(idx); |
317 |
+ return(NULL); |
318 |
+ } |
319 |
+ |
320 |
/* make space for the offsets */ |
321 |
- idx->offset = (long *) malloc(idx->off_cnt * (sizeof(long))); |
322 |
+ idx->offset = (unsigned long *) malloc(idx->off_cnt * sizeof(long)); |
323 |
assert(idx->offset); |
324 |
|
325 |
/* get the offsets */ |
326 |
@@ -197,15 +197,21 @@ IndexPtr getindex(char *searchstr, int dbase) |
327 |
char strings[MAX_FORMS][WORDBUF]; /* vector of search strings */ |
328 |
static IndexPtr offsets[MAX_FORMS]; |
329 |
static int offset; |
330 |
- |
331 |
+ |
332 |
/* This works like strrok(): if passed with a non-null string, |
333 |
prepare vector of search strings and offsets. If string |
334 |
is null, look at current list of offsets and return next |
335 |
one, or NULL if no more alternatives for this word. */ |
336 |
|
337 |
if (searchstr != NULL) { |
338 |
- |
339 |
- offset = 0; |
340 |
+ /* Bail out if the input is too long for us to handle */ |
341 |
+ if (strlen(searchstr) > (WORDBUF - 1)) { |
342 |
+ strcpy(msgbuf, "WordNet library error: search term is too long\n"); |
343 |
+ display_message(msgbuf); |
344 |
+ return(NULL); |
345 |
+ } |
346 |
+ |
347 |
+ offset = 0; |
348 |
strtolower(searchstr); |
349 |
for (i = 0; i < MAX_FORMS; i++) { |
350 |
strcpy(strings[i], searchstr); |
351 |
@@ -229,11 +235,11 @@ IndexPtr getindex(char *searchstr, int dbase) |
352 |
/* Get offset of first entry. Then eliminate duplicates |
353 |
and get offsets of unique strings. */ |
354 |
|
355 |
- if (strings[0][0] != NULL) |
356 |
+ if (strings[0] != NULL) |
357 |
offsets[0] = index_lookup(strings[0], dbase); |
358 |
|
359 |
for (i = 1; i < MAX_FORMS; i++) |
360 |
- if ((strings[i][0]) != NULL && (strcmp(strings[0], strings[i]))) |
361 |
+ if (strings[i] != NULL && (strcmp(strings[0], strings[i]))) |
362 |
offsets[i] = index_lookup(strings[i], dbase); |
363 |
} |
364 |
|
365 |
@@ -272,7 +278,7 @@ SynsetPtr read_synset(int dbase, long boffset, char *word) |
366 |
SynsetPtr parse_synset(FILE *fp, int dbase, char *word) |
367 |
{ |
368 |
static char line[LINEBUF]; |
369 |
- char tbuf[SMLINEBUF]; |
370 |
+ char tbuf[SMLINEBUF] = ""; |
371 |
char *ptrtok; |
372 |
char *tmpptr; |
373 |
int foundpert = 0; |
374 |
@@ -286,33 +292,11 @@ SynsetPtr parse_synset(FILE *fp, int dbase, char *word) |
375 |
if ((tmpptr = fgets(line, LINEBUF, fp)) == NULL) |
376 |
return(NULL); |
377 |
|
378 |
- synptr = (SynsetPtr)malloc(sizeof(Synset)); |
379 |
+ synptr = (SynsetPtr)calloc(1, sizeof(Synset)); |
380 |
assert(synptr); |
381 |
- |
382 |
- synptr->hereiam = 0; |
383 |
+ |
384 |
synptr->sstype = DONT_KNOW; |
385 |
- synptr->fnum = 0; |
386 |
- synptr->pos = '\0'; |
387 |
- synptr->wcount = 0; |
388 |
- synptr->words = '\0'; |
389 |
- synptr->whichword = 0; |
390 |
- synptr->ptrcount = 0; |
391 |
- synptr->ptrtyp = '\0'; |
392 |
- synptr->ptroff = '\0'; |
393 |
- synptr->ppos = '\0'; |
394 |
- synptr->pto = '\0'; |
395 |
- synptr->pfrm = '\0'; |
396 |
- synptr->fcount = 0; |
397 |
- synptr->frmid = '\0'; |
398 |
- synptr->frmto = '\0'; |
399 |
- synptr->defn = '\0'; |
400 |
- synptr->key = 0; |
401 |
- synptr->nextss = NULL; |
402 |
- synptr->nextform = NULL; |
403 |
synptr->searchtype = -1; |
404 |
- synptr->ptrlist = NULL; |
405 |
- synptr->headword = NULL; |
406 |
- synptr->headsense = 0; |
407 |
|
408 |
ptrtok = line; |
409 |
|
410 |
@@ -322,7 +306,7 @@ SynsetPtr parse_synset(FILE *fp, int dbase, char *word) |
411 |
|
412 |
/* sanity check - make sure starting file offset matches first field */ |
413 |
if (synptr->hereiam != loc) { |
414 |
- sprintf(msgbuf, "WordNet library error: no synset at location %d\n", |
415 |
+ sprintf(msgbuf, "WordNet library error: no synset at location %ld\n", |
416 |
loc); |
417 |
display_message(msgbuf); |
418 |
free(synptr); |
419 |
@@ -335,16 +319,20 @@ SynsetPtr parse_synset(FILE *fp, int dbase, char *word) |
420 |
|
421 |
/* looking at POS */ |
422 |
ptrtok = strtok(NULL, " \n"); |
423 |
- synptr->pos = malloc(strlen(ptrtok) + 1); |
424 |
+ synptr->pos = strdup(ptrtok); |
425 |
assert(synptr->pos); |
426 |
- strcpy(synptr->pos, ptrtok); |
427 |
if (getsstype(synptr->pos) == SATELLITE) |
428 |
synptr->sstype = INDIRECT_ANT; |
429 |
|
430 |
/* looking at numwords */ |
431 |
ptrtok = strtok(NULL, " \n"); |
432 |
synptr->wcount = strtol(ptrtok, NULL, 16); |
433 |
- |
434 |
+ |
435 |
+ if (synptr->wcount < 0 || (unsigned int)synptr->wcount > UINT_MAX/sizeof(char *)) { |
436 |
+ free_syns(synptr); |
437 |
+ return(NULL); |
438 |
+ } |
439 |
+ |
440 |
synptr->words = (char **)malloc(synptr->wcount * sizeof(char *)); |
441 |
assert(synptr->words); |
442 |
synptr->wnsns = (int *)malloc(synptr->wcount * sizeof(int)); |
443 |
@@ -354,9 +342,8 @@ SynsetPtr parse_synset(FILE *fp, int dbase, char *word) |
444 |
|
445 |
for (i = 0; i < synptr->wcount; i++) { |
446 |
ptrtok = strtok(NULL, " \n"); |
447 |
- synptr->words[i] = malloc(strlen(ptrtok) + 1); |
448 |
+ synptr->words[i] = strdup(ptrtok); |
449 |
assert(synptr->words[i]); |
450 |
- strcpy(synptr->words[i], ptrtok); |
451 |
|
452 |
/* is this the word we're looking for? */ |
453 |
|
454 |
@@ -371,6 +358,12 @@ SynsetPtr parse_synset(FILE *fp, int dbase, char *word) |
455 |
ptrtok = strtok(NULL," \n"); |
456 |
synptr->ptrcount = atoi(ptrtok); |
457 |
|
458 |
+ /* Should we check for long here as well? */ |
459 |
+ if (synptr->ptrcount < 0 || (unsigned int)synptr->ptrcount > UINT_MAX/sizeof(int)) { |
460 |
+ free_syns(synptr); |
461 |
+ return(NULL); |
462 |
+ } |
463 |
+ |
464 |
if (synptr->ptrcount) { |
465 |
|
466 |
/* alloc storage for the pointers */ |
467 |
@@ -455,21 +448,23 @@ SynsetPtr parse_synset(FILE *fp, int dbase, char *word) |
468 |
ptrtok = strtok(NULL," \n"); |
469 |
if (ptrtok) { |
470 |
ptrtok = strtok(NULL," \n"); |
471 |
- sprintf(tbuf, ""); |
472 |
while (ptrtok != NULL) { |
473 |
+ if (strlen(ptrtok) + strlen(tbuf) + 1 + 1 > sizeof(tbuf)) { |
474 |
+ free_syns(synptr); |
475 |
+ return(NULL); |
476 |
+ } |
477 |
strcat(tbuf,ptrtok); |
478 |
ptrtok = strtok(NULL, " \n"); |
479 |
if(ptrtok) |
480 |
strcat(tbuf," "); |
481 |
} |
482 |
- assert((1 + strlen(tbuf)) < sizeof(tbuf)); |
483 |
- synptr->defn = malloc(strlen(tbuf) + 4); |
484 |
+ synptr->defn = malloc(strlen(tbuf) + 3); |
485 |
assert(synptr->defn); |
486 |
sprintf(synptr->defn,"(%s)",tbuf); |
487 |
} |
488 |
|
489 |
if (keyindexfp) { /* we have unique keys */ |
490 |
- sprintf(tmpbuf, "%c:%8.8d", partchars[dbase], synptr->hereiam); |
491 |
+ sprintf(tmpbuf, "%c:%8.8ld", partchars[dbase], synptr->hereiam); |
492 |
synptr->key = GetKeyForOffset(tmpbuf); |
493 |
} |
494 |
|
495 |
@@ -635,7 +630,7 @@ static void traceptrs(SynsetPtr synptr, int ptrtyp, int dbase, int depth) |
496 |
|
497 |
if ((ptrtyp == PERTPTR || ptrtyp == PPLPTR) && |
498 |
synptr->pto[i] != 0) { |
499 |
- sprintf(tbuf, " (Sense %d)\n", |
500 |
+ snprintf(tbuf, sizeof(tbuf), " (Sense %d)\n", |
501 |
cursyn->wnsns[synptr->pto[i] - 1]); |
502 |
printsynset(prefix, cursyn, tbuf, DEFOFF, synptr->pto[i], |
503 |
SKIP_ANTS, PRINT_MARKER); |
504 |
@@ -656,7 +651,7 @@ static void traceptrs(SynsetPtr synptr, int ptrtyp, int dbase, int depth) |
505 |
traceptrs(cursyn, HYPERPTR, getpos(cursyn->pos), 0); |
506 |
} |
507 |
} else if (ptrtyp == ANTPTR && dbase != ADJ && synptr->pto[i] != 0) { |
508 |
- sprintf(tbuf, " (Sense %d)\n", |
509 |
+ snprintf(tbuf, sizeof(tbuf), " (Sense %d)\n", |
510 |
cursyn->wnsns[synptr->pto[i] - 1]); |
511 |
printsynset(prefix, cursyn, tbuf, DEFOFF, synptr->pto[i], |
512 |
SKIP_ANTS, PRINT_MARKER); |
513 |
@@ -817,7 +812,7 @@ static void tracenomins(SynsetPtr synptr, int dbase) |
514 |
|
515 |
cursyn = read_synset(synptr->ppos[i], synptr->ptroff[i], ""); |
516 |
|
517 |
- sprintf(tbuf, "#%d\n", |
518 |
+ snprintf(tbuf, sizeof(tbuf), "#%d\n", |
519 |
cursyn->wnsns[synptr->pto[i] - 1]); |
520 |
printsynset(prefix, cursyn, tbuf, DEFOFF, synptr->pto[i], |
521 |
SKIP_ANTS, SKIP_MARKER); |
522 |
@@ -989,12 +984,12 @@ void getexample(char *offset, char *wd) |
523 |
char sentbuf[512]; |
524 |
|
525 |
if (vsentfilefp != NULL) { |
526 |
- if (line = bin_search(offset, vsentfilefp)) { |
527 |
+ if ((line = bin_search(offset, vsentfilefp)) != NULL) { |
528 |
while(*line != ' ') |
529 |
line++; |
530 |
|
531 |
printbuffer(" EX: "); |
532 |
- sprintf(sentbuf, line, wd); |
533 |
+ snprintf(sentbuf, sizeof(sentbuf), line, wd); |
534 |
printbuffer(sentbuf); |
535 |
} |
536 |
} |
537 |
@@ -1011,7 +1006,7 @@ int findexample(SynsetPtr synptr) |
538 |
if (vidxfilefp != NULL) { |
539 |
wdnum = synptr->whichword - 1; |
540 |
|
541 |
- sprintf(tbuf,"%s%%%-1.1d:%-2.2d:%-2.2d::", |
542 |
+ snprintf(tbuf, sizeof(tbuf), "%s%%%-1.1d:%-2.2d:%-2.2d::", |
543 |
synptr->words[wdnum], |
544 |
getpos(synptr->pos), |
545 |
synptr->fnum, |
546 |
@@ -1124,7 +1119,7 @@ static void freq_word(IndexPtr index) |
547 |
if (cnt >= 17 && cnt <= 32) familiar = 6; |
548 |
if (cnt > 32 ) familiar = 7; |
549 |
|
550 |
- sprintf(tmpbuf, |
551 |
+ snprintf(tmpbuf, sizeof(tmpbuf), |
552 |
"\n%s used as %s is %s (polysemy count = %d)\n", |
553 |
index->wd, a_an[getpos(index->pos)], freqcats[familiar], cnt); |
554 |
printbuffer(tmpbuf); |
555 |
@@ -1147,6 +1142,9 @@ void wngrep (char *word_passed, int pos) { |
556 |
} |
557 |
rewind(inputfile); |
558 |
|
559 |
+ if (strlen(word_passed) + 1 > sizeof(word)) |
560 |
+ return; |
561 |
+ |
562 |
strcpy (word, word_passed); |
563 |
ToLowerCase(word); /* map to lower case for index file search */ |
564 |
strsubst (word, ' ', '_'); /* replace spaces with underscores */ |
565 |
@@ -1169,7 +1167,7 @@ void wngrep (char *word_passed, int pos) { |
566 |
((line[loc + wordlen] == '-') || (line[loc + wordlen] == '_'))) |
567 |
) { |
568 |
strsubst (line, '_', ' '); |
569 |
- sprintf (tmpbuf, "%s\n", line); |
570 |
+ snprintf (tmpbuf, sizeof(tmpbuf), "%s\n", line); |
571 |
printbuffer (tmpbuf); |
572 |
break; |
573 |
} |
574 |
@@ -1570,7 +1568,8 @@ char *findtheinfo(char *searchstr, int dbase, int ptrtyp, int whichsense) |
575 |
bufstart[0] = '\n'; |
576 |
bufstart++; |
577 |
} |
578 |
- strncpy(bufstart, tmpbuf, strlen(tmpbuf)); |
579 |
+ /* Don't include the \0 */ |
580 |
+ memcpy(bufstart, tmpbuf, strlen(tmpbuf)); |
581 |
bufstart = searchbuffer + strlen(searchbuffer); |
582 |
} |
583 |
} |
584 |
@@ -1683,9 +1682,8 @@ SynsetPtr traceptrs_ds(SynsetPtr synptr, int ptrtyp, int dbase, int depth) |
585 |
cursyn = read_synset(synptr->ppos[i], |
586 |
synptr->ptroff[i], |
587 |
""); |
588 |
- synptr->headword = malloc(strlen(cursyn->words[0]) + 1); |
589 |
+ synptr->headword = strdup(cursyn->words[0]); |
590 |
assert(synptr->headword); |
591 |
- strcpy(synptr->headword, cursyn->words[0]); |
592 |
synptr->headsense = cursyn->lexid[0]; |
593 |
free_synset(cursyn); |
594 |
break; |
595 |
@@ -2013,7 +2011,7 @@ static int getsearchsense(SynsetPtr synptr, int whichword) |
596 |
strsubst(strcpy(wdbuf, synptr->words[whichword - 1]), ' ', '_'); |
597 |
strtolower(wdbuf); |
598 |
|
599 |
- if (idx = index_lookup(wdbuf, getpos(synptr->pos))) { |
600 |
+ if ((idx = index_lookup(wdbuf, getpos(synptr->pos))) != NULL) { |
601 |
for (i = 0; i < idx->off_cnt; i++) |
602 |
if (idx->offset[i] == synptr->hereiam) { |
603 |
free_index(idx); |
604 |
@@ -2037,7 +2035,7 @@ static void printsynset(char *head, SynsetPtr synptr, char *tail, int definition |
605 |
by flags */ |
606 |
|
607 |
if (offsetflag) /* print synset offset */ |
608 |
- sprintf(tbuf + strlen(tbuf),"{%8.8d} ", synptr->hereiam); |
609 |
+ sprintf(tbuf + strlen(tbuf),"{%8.8ld} ", synptr->hereiam); |
610 |
if (fileinfoflag) { /* print lexicographer file information */ |
611 |
sprintf(tbuf + strlen(tbuf), "<%s> ", lexfiles[synptr->fnum]); |
612 |
prlexid = 1; /* print lexicographer id after word */ |
613 |
@@ -2072,7 +2070,7 @@ static void printantsynset(SynsetPtr synptr, char *tail, int anttype, int defini |
614 |
tbuf[0] = '\0'; |
615 |
|
616 |
if (offsetflag) |
617 |
- sprintf(tbuf,"{%8.8d} ", synptr->hereiam); |
618 |
+ sprintf(tbuf,"{%8.8ld} ", synptr->hereiam); |
619 |
if (fileinfoflag) { |
620 |
sprintf(tbuf + strlen(tbuf),"<%s> ", lexfiles[synptr->fnum]); |
621 |
prlexid = 1; |
622 |
diff --git a/lib/wnutil.c b/lib/wnutil.c |
623 |
index 5ee5d76..7b7948a 100644 |
624 |
--- a/lib/wnutil.c |
625 |
+++ b/lib/wnutil.c |
626 |
@@ -48,7 +48,7 @@ int wninit(void) |
627 |
char *env; |
628 |
|
629 |
if (!done) { |
630 |
- if (env = getenv("WNDBVERSION")) { |
631 |
+ if ((env = getenv("WNDBVERSION")) != NULL) { |
632 |
wnrelease = strdup(env); /* set release */ |
633 |
assert(wnrelease); |
634 |
} |
635 |
@@ -70,7 +70,7 @@ int re_wninit(void) |
636 |
|
637 |
closefps(); |
638 |
|
639 |
- if (env = getenv("WNDBVERSION")) { |
640 |
+ if ((env = getenv("WNDBVERSION")) != NULL) { |
641 |
wnrelease = strdup(env); /* set release */ |
642 |
assert(wnrelease); |
643 |
} |
644 |
@@ -149,25 +149,25 @@ static int do_init(void) |
645 |
sprintf(searchdir, DEFAULTPATH); |
646 |
#else |
647 |
if ((env = getenv("WNSEARCHDIR")) != NULL) |
648 |
- strcpy(searchdir, env); |
649 |
+ snprintf(searchdir, sizeof(searchdir), "%s", env); |
650 |
else if ((env = getenv("WNHOME")) != NULL) |
651 |
- sprintf(searchdir, "%s%s", env, DICTDIR); |
652 |
+ snprintf(searchdir, sizeof(searchdir), "%s%s", env, DICTDIR); |
653 |
else |
654 |
strcpy(searchdir, DEFAULTPATH); |
655 |
#endif |
656 |
|
657 |
for (i = 1; i < NUMPARTS + 1; i++) { |
658 |
- sprintf(tmpbuf, DATAFILE, searchdir, partnames[i]); |
659 |
+ snprintf(tmpbuf, sizeof(tmpbuf), DATAFILE, searchdir, partnames[i]); |
660 |
if((datafps[i] = fopen(tmpbuf, "r")) == NULL) { |
661 |
- sprintf(msgbuf, |
662 |
+ snprintf(msgbuf, sizeof(msgbuf), |
663 |
"WordNet library error: Can't open datafile(%s)\n", |
664 |
tmpbuf); |
665 |
display_message(msgbuf); |
666 |
openerr = -1; |
667 |
} |
668 |
- sprintf(tmpbuf, INDEXFILE, searchdir, partnames[i]); |
669 |
+ snprintf(tmpbuf, sizeof(tmpbuf), INDEXFILE, searchdir, partnames[i]); |
670 |
if((indexfps[i] = fopen(tmpbuf, "r")) == NULL) { |
671 |
- sprintf(msgbuf, |
672 |
+ snprintf(msgbuf, sizeof(msgbuf), |
673 |
"WordNet library error: Can't open indexfile(%s)\n", |
674 |
tmpbuf); |
675 |
display_message(msgbuf); |
676 |
@@ -178,35 +178,35 @@ static int do_init(void) |
677 |
/* This file isn't used by the library and doesn't have to |
678 |
be present. No error is reported if the open fails. */ |
679 |
|
680 |
- sprintf(tmpbuf, SENSEIDXFILE, searchdir); |
681 |
+ snprintf(tmpbuf, sizeof(tmpbuf), SENSEIDXFILE, searchdir); |
682 |
sensefp = fopen(tmpbuf, "r"); |
683 |
|
684 |
/* If this file isn't present, the runtime code will skip printint out |
685 |
the number of times each sense was tagged. */ |
686 |
|
687 |
- sprintf(tmpbuf, CNTLISTFILE, searchdir); |
688 |
+ snprintf(tmpbuf, sizeof(tmpbuf), CNTLISTFILE, searchdir); |
689 |
cntlistfp = fopen(tmpbuf, "r"); |
690 |
|
691 |
/* This file doesn't have to be present. No error is reported if the |
692 |
open fails. */ |
693 |
|
694 |
- sprintf(tmpbuf, KEYIDXFILE, searchdir); |
695 |
+ snprintf(tmpbuf, sizeof(tmpbuf), KEYIDXFILE, searchdir); |
696 |
keyindexfp = fopen(tmpbuf, "r"); |
697 |
|
698 |
- sprintf(tmpbuf, REVKEYIDXFILE, searchdir); |
699 |
+ snprintf(tmpbuf, sizeof(tmpbuf), REVKEYIDXFILE, searchdir); |
700 |
revkeyindexfp = fopen(tmpbuf, "r"); |
701 |
|
702 |
- sprintf(tmpbuf, VRBSENTFILE, searchdir); |
703 |
+ snprintf(tmpbuf, sizeof(tmpbuf), VRBSENTFILE, searchdir); |
704 |
if ((vsentfilefp = fopen(tmpbuf, "r")) == NULL) { |
705 |
- sprintf(msgbuf, |
706 |
+ snprintf(msgbuf, sizeof(msgbuf), |
707 |
"WordNet library warning: Can't open verb example sentence file(%s)\n", |
708 |
tmpbuf); |
709 |
display_message(msgbuf); |
710 |
} |
711 |
|
712 |
- sprintf(tmpbuf, VRBIDXFILE, searchdir); |
713 |
+ snprintf(tmpbuf, sizeof(tmpbuf), VRBIDXFILE, searchdir); |
714 |
if ((vidxfilefp = fopen(tmpbuf, "r")) == NULL) { |
715 |
- sprintf(msgbuf, |
716 |
+ snprintf(msgbuf, sizeof(msgbuf), |
717 |
"WordNet library warning: Can't open verb example sentence index file(%s)\n", |
718 |
tmpbuf); |
719 |
display_message(msgbuf); |
720 |
diff --git a/src/wn.c b/src/wn.c |
721 |
index ddb27aa..5c6a255 100644 |
722 |
--- a/src/wn.c |
723 |
+++ b/src/wn.c |
724 |
@@ -129,7 +129,7 @@ static void printusage(), printlicense(), |
725 |
printsearches(char *, int, unsigned long); |
726 |
static int error_message(char *); |
727 |
|
728 |
-main(int argc,char *argv[]) |
729 |
+int main(int argc,char *argv[]) |
730 |
{ |
731 |
display_message = error_message; |
732 |
|
733 |
@@ -225,14 +225,14 @@ static int do_search(char *searchword, int pos, int search, int whichsense, |
734 |
printf("\n%s of %s %s\n%s", |
735 |
label, partnames[pos], searchword, outbuf); |
736 |
|
737 |
- if (morphword = morphstr(searchword, pos)) |
738 |
+ if ((morphword = morphstr(searchword, pos)) != NULL) |
739 |
do { |
740 |
outbuf = findtheinfo(morphword, pos, search, whichsense); |
741 |
totsenses += wnresults.printcnt; |
742 |
if (strlen(outbuf) > 0) |
743 |
printf("\n%s of %s %s\n%s", |
744 |
label, partnames[pos], morphword, outbuf); |
745 |
- } while (morphword = morphstr(NULL, pos)); |
746 |
+ } while ((morphword = morphstr(NULL, pos)) != NULL); |
747 |
|
748 |
return(totsenses); |
749 |
} |