diff -ur logrotate-3.6.2~/logrotate.c logrotate-3.6.2/logrotate.c

--- logrotate-3.6.2~/logrotate.c	Sat Mar 23 23:31:19 2002

+++ logrotate-3.6.2/logrotate.c	Sat Mar 23 23:53:56 2002

@@ -308,6 +308,7 @@

     char * baseName;

     char * dirName;

     char * firstRotated;

+    size_t namelen;

     int rotateCount = log->rotateCount ? log->rotateCount : 1;

     int logStart = (log->logStart == -1) ? 1 : log->logStart;

@@ -331,42 +332,44 @@

         dirName = ourDirName(log->files[logNum]);

     baseName = strdup(ourBaseName(log->files[logNum]));

-    oldName = alloca(strlen(dirName) + strlen(baseName) + 

-                     strlen(log->files[logNum]) + 10);

-    newName = alloca(strlen(dirName) + strlen(baseName) + 

-                     strlen(log->files[logNum]) + 10);

-    disposeName = alloca(strlen(dirName) + strlen(baseName) + 

-                         strlen(log->files[logNum]) + 10);

-    

     if (log->extension &&

 	strncmp(&baseName[strlen(baseName)-strlen(log->extension)],

 		log->extension, strlen(log->extension)) == 0) {

-        char *tempstr;

-	

+        char *tempstr = calloc (strlen(baseName)-strlen(log->extension)+1, sizeof(char));

         fileext = log->extension;

-        tempstr = calloc(strlen(baseName)-strlen(log->extension)+1, sizeof(char));

         strncat(tempstr, baseName,

                 strlen(baseName)-strlen(log->extension));

         free(baseName);

         baseName = tempstr;

     }

+    namelen = strlen (dirName) +

+    	strlen (baseName) +

+	strlen (log->files[logNum]) +

+	strlen (fileext) +

+	strlen (compext) +

+	32;

+    oldName = alloca (namelen);

+    newName = alloca (namelen);

+    disposeName = alloca (namelen);

+

     /* First compress the previous log when necessary */

     if (log->flags & LOG_FLAG_COMPRESS &&

         log->flags & LOG_FLAG_DELAYCOMPRESS) {

         struct stat sbprev;

-        sprintf(oldName, "%s/%s.%d%s", dirName, baseName, logStart, fileext);

+        snprintf(oldName, namelen, "%s/%s.%d%s", dirName, baseName, logStart, fileext);

         if (stat(oldName, &sbprev)) {

             message(MESS_DEBUG, "previous log %s does not exist\n",

 		    oldName);

         } else {

-            char * command;

-	    

-            command = alloca(strlen(log->compress_prog) +

-                             strlen(log->compress_options) +

-                             strlen(oldName) + 10);

-            sprintf(command, "%s %s '%s'", log->compress_prog,

+	    const char cmd_fmt[] = "%s %s '%s'";

+	    size_t len = sizeof(cmd_fmt) +

+			 strlen(log->compress_prog) +

+			 strlen(log->compress_options) +

+			 strlen(oldName);

+	    char *command = alloca(len);

+	    snprintf(command, len, cmd_fmt, log->compress_prog,

                     log->compress_options, oldName);

             message(MESS_DEBUG, "compressing previous log with: %s\n",

 		    command);

@@ -378,21 +381,20 @@

 	}

     }

-    sprintf(oldName, "%s/%s.%d%s%s", dirName, baseName,

+    snprintf(oldName, namelen, "%s/%s.%d%s%s", dirName, baseName,

             logStart + rotateCount, fileext, compext);

     strcpy(disposeName, oldName);

-    firstRotated = alloca(strlen(dirName) + strlen(baseName) +

-                          strlen(fileext) + strlen(compext) + 30);

-    sprintf(firstRotated, "%s/%s.%d%s%s", dirName, baseName,

+    firstRotated = alloca(namelen);

+    snprintf(firstRotated, namelen, "%s/%s.%d%s%s", dirName, baseName,

             logStart, fileext, compext);

     for (i = rotateCount + logStart; i && !hasErrors; i--) {

         tmp = newName;

         newName = oldName;

         oldName = tmp;

-        sprintf(oldName, "%s/%s.%d%s%s", dirName, baseName, i,

+        snprintf(oldName, namelen, "%s/%s.%d%s%s", dirName, baseName, i,

                 fileext, compext);

         message(MESS_DEBUG, "renaming %s to %s\n", oldName, newName);

@@ -412,7 +414,7 @@

     finalName = oldName;

     /* note: the gzip extension is *not* used here! */

-    sprintf(finalName, "%s/%s.%d%s", dirName, baseName, logStart, fileext);

+    snprintf(finalName, namelen, "%s/%s.%d%s", dirName, baseName, logStart, fileext);

     /* if the last rotation doesn't exist, that's okay */

     if (!debug && access(disposeName, F_OK)) {

@@ -521,12 +523,13 @@

         if (!hasErrors && log->rotateCount && 

 	    (log->flags & LOG_FLAG_COMPRESS) &&

 	    !(log->flags & LOG_FLAG_DELAYCOMPRESS)) {

-            char * command;

-	    

-            command = alloca(strlen(log->compress_prog) +

-                             strlen(log->compress_options) +

-                             strlen(oldName) + 10);

-            sprintf(command, "%s %s '%s'", log->compress_prog,

+	    const char cmd_fmt[] = "%s %s '%s'";

+	    size_t len = sizeof(cmd_fmt) +

+			 strlen(log->compress_prog) +

+			 strlen(log->compress_options) +

+			 strlen(finalName);

+	    char *command = alloca(len);

+	    snprintf(command, len, cmd_fmt, log->compress_prog,

                     log->compress_options, finalName);

             message(MESS_DEBUG, "compressing new log with: %s\n", command);

             if (!debug && system(command)) {

@@ -537,6 +540,8 @@

         }

         if (!hasErrors && log->logAddress) {

+            const char cmd1_format[] = "%s < %s | %s '%s' %s";

+            const char cmd2_format[] = "%s '%s' %s < %s";

             char * command;

             char * mailFilename;

@@ -546,24 +551,38 @@

                 mailFilename = disposeName;

             if (mailFilename) {

-                command = alloca(strlen(mailFilename) + 100 + 

-                                 strlen(log->uncompress_prog));

-		

                 if ((log->flags & LOG_FLAG_COMPRESS) &&

 		    !(log->flags & LOG_FLAG_DELAYCOMPRESS) &&

-		    (log->flags & LOG_FLAG_MAILFIRST))

-                    sprintf(command, "%s < %s | %s '%s' %s", 

+		    (log->flags & LOG_FLAG_MAILFIRST)) {

+		    size_t len = sizeof(cmd1_format) +

+				 strlen(log->uncompress_prog) +

+				 strlen(mailFilename) +

+				 strlen(mailCommand) +

+				 strlen(log->files[logNum]) +

+				 strlen(log->logAddress);

+

+                    command = alloca(len);

+                    snprintf(command, len, cmd1_format, 

 			    log->uncompress_prog, mailFilename, mailCommand,

 			    log->files[logNum],

 			    log->logAddress);

-                else

-                    sprintf(command, "%s '%s' %s < %s", mailCommand, 

+                }

+                else {

+		    size_t len = sizeof(cmd2_format) +

+				 strlen(mailCommand) +

+				 strlen(mailFilename) +

+				 strlen(log->logAddress) +

+				 strlen(mailFilename);

+

+                    command = alloca(len);

+                    snprintf(command, len, cmd2_format, mailCommand, 

 			    mailFilename, log->logAddress, mailFilename);

+                }

                 message(MESS_DEBUG, "executing: \"%s\"\n", command);

                 if (!debug && system(command)) {

-                    sprintf(newName, "%s.%d", log->files[logNum], getpid());

+                    snprintf(newName, namelen, "%s.%d", log->files[logNum], getpid());

                     fprintf(errorFile, "Failed to mail %s to %s!\n",

                             mailFilename, log->logAddress);