MFH

diff --git a/ext/soap/soap.c b/ext/soap/soap.c
index cf0333ff6787e7f05a64c010c559de44b8fbc4f2..7c990fd33b0e71bed6312e09f927059351b67a0e 100644 (file)
--- a/ext/soap/soap.c
+++ b/ext/soap/soap.c
@@ -1853,7 +1853,7 @@ PHP_METHOD(SoapServer, handle)
                        php_error_docref(NULL TSRMLS_CC, E_ERROR, "Dump memory failed");
                }       
 
-               sprintf(cont_len, "Content-Length: %d", size);
+               snprintf(cont_len, sizeof(cont_len), "Content-Length: %d", size);
                sapi_add_header(cont_len, strlen(cont_len), 1);
                if (soap_version == SOAP_1_2) {
                        sapi_add_header("Content-Type: application/soap+xml; charset=utf-8", sizeof("Content-Type: application/soap+xml; charset=utf-8")-1, 1);
@@ -1982,7 +1982,7 @@ static void soap_server_fault_ex(sdlFunctionPtr function, zval* fault, soapHeade
           our fault code with their own handling... Figure this out later
        */
        sapi_add_header("HTTP/1.1 500 Internal Service Error", sizeof("HTTP/1.1 500 Internal Service Error")-1, 1);
-       sprintf(cont_len,"Content-Length: %d", size);
+       snprintf(cont_len, sizeof(cont_len), "Content-Length: %d", size);
        sapi_add_header(cont_len, strlen(cont_len), 1);
        if (soap_version == SOAP_1_2) {
                sapi_add_header("Content-Type: application/soap+xml; charset=utf-8", sizeof("Content-Type: application/soap+xml; charset=utf-8")-1, 1);
@@ -4223,7 +4223,7 @@ static xmlNodePtr serialize_parameter(sdlParamPtr param, zval *param_val, int in
        } else {
                if (name == NULL) {
                        paramName = paramNameBuf;
-                       sprintf(paramName,"param%d",index);
+                       snprintf(paramName, sizeof(paramNameBuf), "param%d",index);
                } else {
                        paramName = name;
                }

diff --git a/ext/standard/html.c b/ext/standard/html.c
index b71d724df720933f9c87f6a9ad2891af80a18bee..5da3eaae07f17227f790404cf57997b9ee16362a 100644 (file)
--- a/ext/standard/html.c
+++ b/ext/standard/html.c
@@ -1354,7 +1354,7 @@ PHP_FUNCTION(get_html_translation_table)
                                                continue;
                                        /* what about wide chars here ?? */
                                        ind[0] = i + entity_map[j].basechar;
-                                       sprintf(buffer, "&%s;", entity_map[j].table[i]);
+                                       snprintf(buffer, sizeof(buffer), "&%s;", entity_map[j].table[i]);
                                        add_assoc_string(return_value, ind, buffer, 1);
 
                                }

diff --git a/ext/wddx/wddx.c b/ext/wddx/wddx.c
index 33f496852893935dbfad3c4b2c9d50a0172c8c45..b4900eb662b040b91970cfe8c0b9f10dcc6cba01 100644 (file)
--- a/ext/wddx/wddx.c
+++ b/ext/wddx/wddx.c
@@ -448,7 +448,7 @@ static void php_wddx_serialize_object(wddx_packet *packet, zval *obj)
                        PHP_SET_CLASS_ATTRIBUTES(obj);
 
                        php_wddx_add_chunk_static(packet, WDDX_STRUCT_S);
-                       sprintf(tmp_buf, WDDX_VAR_S, PHP_CLASS_NAME_VAR);
+                       snprintf(tmp_buf, WDDX_BUF_LEN, WDDX_VAR_S, PHP_CLASS_NAME_VAR);
                        php_wddx_add_chunk(packet, tmp_buf);
                        php_wddx_add_chunk_static(packet, WDDX_STRING_S);
                        php_wddx_add_chunk_ex(packet, class_name, name_len);
@@ -480,7 +480,7 @@ static void php_wddx_serialize_object(wddx_packet *packet, zval *obj)
                PHP_SET_CLASS_ATTRIBUTES(obj);
 
                php_wddx_add_chunk_static(packet, WDDX_STRUCT_S);
-               sprintf(tmp_buf, WDDX_VAR_S, PHP_CLASS_NAME_VAR);
+               snprintf(tmp_buf, WDDX_BUF_LEN, WDDX_VAR_S, PHP_CLASS_NAME_VAR);
                php_wddx_add_chunk(packet, tmp_buf);
                php_wddx_add_chunk_static(packet, WDDX_STRING_S);
                php_wddx_add_chunk_ex(packet, class_name, name_len);