weakref_repr(), proxy_repr(): Conversion of sprintf() to

PyOS_snprintf() for buffer overrun avoidance.

diff --git a/Objects/weakrefobject.c b/Objects/weakrefobject.c
index 6261a8703f2c9cb2939487715351bac744c64917..fb58ff4c7f3ff71ca335830f929f3b84aeb2ecae 100644 (file)
--- a/Objects/weakrefobject.c
+++ b/Objects/weakrefobject.c
@@ -131,13 +131,15 @@ weakref_repr(PyWeakReference *self)
 {
     char buffer[256];
     if (PyWeakref_GET_OBJECT(self) == Py_None) {
-        sprintf(buffer, "<weakref at %lx; dead>",
-                (long)(self));
+        PyOS_snprintf(buffer, sizeof(buffer), "<weakref at %lx; dead>",
+                     (long)(self));
     }
     else {
-        sprintf(buffer, "<weakref at %#lx; to '%.50s' at %#lx>",
-                (long)(self), PyWeakref_GET_OBJECT(self)->ob_type->tp_name,
-                (long)(PyWeakref_GET_OBJECT(self)));
+        PyOS_snprintf(buffer, sizeof(buffer),
+                     "<weakref at %#lx; to '%.50s' at %#lx>",
+                     (long)(self),
+                     PyWeakref_GET_OBJECT(self)->ob_type->tp_name,
+                     (long)(PyWeakref_GET_OBJECT(self)));
     }
     return PyString_FromString(buffer);
 }
@@ -265,9 +267,10 @@ static PyObject *
 proxy_repr(PyWeakReference *proxy)
 {
     char buf[160];
-    sprintf(buf, "<weakref at %p to %.100s at %p>", proxy,
-            PyWeakref_GET_OBJECT(proxy)->ob_type->tp_name,
-            PyWeakref_GET_OBJECT(proxy));
+    PyOS_snprintf(buf, sizeof(buf),
+                 "<weakref at %p to %.100s at %p>", proxy,
+                 PyWeakref_GET_OBJECT(proxy)->ob_type->tp_name,
+                 PyWeakref_GET_OBJECT(proxy));
     return PyString_FromString(buf);
 }