weakref_repr(), proxy_repr(): Conversion of sprintf() to

PyOS_snprintf() for buffer overrun avoidance.

1 files changed, 11 insertions, 8 deletions

diff --git a/Objects/weakrefobject.c b/Objects/weakrefobject.c
index 6261a87..fb58ff4 100644
--- a/Objects/weakrefobject.c
+++ b/Objects/weakrefobject.c
@@ -131,13 +131,15 @@ weakref_repr(PyWeakReference *self)
 {
     char buffer[256];
     if (PyWeakref_GET_OBJECT(self) == Py_None) {
-        sprintf(buffer, "<weakref at %lx; dead>",
-                (long)(self));
+        PyOS_snprintf(buffer, sizeof(buffer), "<weakref at %lx; dead>",
+		      (long)(self));
     }
     else {
-        sprintf(buffer, "<weakref at %#lx; to '%.50s' at %#lx>",
-                (long)(self), PyWeakref_GET_OBJECT(self)->ob_type->tp_name,
-                (long)(PyWeakref_GET_OBJECT(self)));
+        PyOS_snprintf(buffer, sizeof(buffer),
+		      "<weakref at %#lx; to '%.50s' at %#lx>",
+		      (long)(self),
+		      PyWeakref_GET_OBJECT(self)->ob_type->tp_name,
+		      (long)(PyWeakref_GET_OBJECT(self)));
     }
     return PyString_FromString(buffer);
 }
@@ -265,9 +267,10 @@ static PyObject *
 proxy_repr(PyWeakReference *proxy)
 {
     char buf[160];
-    sprintf(buf, "<weakref at %p to %.100s at %p>", proxy,
-            PyWeakref_GET_OBJECT(proxy)->ob_type->tp_name,
-            PyWeakref_GET_OBJECT(proxy));
+    PyOS_snprintf(buf, sizeof(buf),
+		  "<weakref at %p to %.100s at %p>", proxy,
+		  PyWeakref_GET_OBJECT(proxy)->ob_type->tp_name,
+		  PyWeakref_GET_OBJECT(proxy));
     return PyString_FromString(buf);
 }