Add a snprinf wrapper which checks that the buffer was big enough

If we scale our buffer to be wide enough for the format string, we
should expect that the calculation was correct.

char_array_0() invocations are removed, since snprintf nul-terminates
the output in any case.

A similar wrapper is used for strftime calls, but only in timedatectl.c.

4 files changed, 13 insertions, 21 deletions

diff --git a/src/shared/log.c b/src/shared/log.c
index a870415a00..9c0156026d 100644
--- a/src/shared/log.c
+++ b/src/shared/log.c
@@ -331,7 +331,6 @@ static int write_to_console(
 
         if (show_location) {
                 snprintf(location, sizeof(location), "(%s:%i) ", file, line);
-                char_array_0(location);
                 IOVEC_SET_STRING(iovec[n++], location);
         }
 
@@ -375,7 +374,9 @@ static int write_to_syslog(
                 const char *object,
                 const char *buffer) {
 
-        char header_priority[1 + DECIMAL_STR_MAX(int) + 2], header_time[64], header_pid[1 + DECIMAL_STR_MAX(pid_t) + 4];
+        char header_priority[2 + DECIMAL_STR_MAX(int) + 1],
+             header_time[64],
+             header_pid[4 + DECIMAL_STR_MAX(pid_t) + 1];
         struct iovec iovec[5] = {};
         struct msghdr msghdr = {
                 .msg_iov = iovec,
@@ -387,8 +388,7 @@ static int write_to_syslog(
         if (syslog_fd < 0)
                 return 0;
 
-        snprintf(header_priority, sizeof(header_priority), "<%i>", level);
-        char_array_0(header_priority);
+        xsprintf(header_priority, "<%i>", level);
 
         t = (time_t) (now(CLOCK_REALTIME) / USEC_PER_SEC);
         tm = localtime(&t);
@@ -398,8 +398,7 @@ static int write_to_syslog(
         if (strftime(header_time, sizeof(header_time), "%h %e %T ", tm) <= 0)
                 return -EINVAL;
 
-        snprintf(header_pid, sizeof(header_pid), "["PID_FMT"]: ", getpid());
-        char_array_0(header_pid);
+        xsprintf(header_pid, "["PID_FMT"]: ", getpid());
 
         IOVEC_SET_STRING(iovec[0], header_priority);
         IOVEC_SET_STRING(iovec[1], header_time);
@@ -438,17 +437,15 @@ static int write_to_kmsg(
                 const char *object,
                 const char *buffer) {
 
-        char header_priority[1 + DECIMAL_STR_MAX(int) + 2], header_pid[1 + DECIMAL_STR_MAX(pid_t) + 4];
+        char header_priority[2 + DECIMAL_STR_MAX(int) + 1],
+             header_pid[4 + DECIMAL_STR_MAX(pid_t) + 1];
         struct iovec iovec[5] = {};
 
         if (kmsg_fd < 0)
                 return 0;
 
-        snprintf(header_priority, sizeof(header_priority), "<%i>", level);
-        char_array_0(header_priority);
-
-        snprintf(header_pid, sizeof(header_pid), "["PID_FMT"]: ", getpid());
-        char_array_0(header_pid);
+        xsprintf(header_priority, "<%i>", level);
+        xsprintf(header_pid, "["PID_FMT"]: ", getpid());
 
         IOVEC_SET_STRING(iovec[0], header_priority);
         IOVEC_SET_STRING(iovec[1], program_invocation_short_name);
@@ -497,7 +494,6 @@ static int log_do_header(
                  isempty(object) ? "" : object,
                  isempty(object) ? "" : "\n",
                  program_invocation_short_name);
-        header[size - 1] = '\0';
 
         return 0;
 }
@@ -659,7 +655,6 @@ int log_internalv(
                 errno = error;
 
         vsnprintf(buffer, sizeof(buffer), format, ap);
-        char_array_0(buffer);
 
         return log_dispatch(level, error, file, line, func, NULL, NULL, buffer);
 }
@@ -707,7 +702,6 @@ int log_object_internalv(
                 errno = error;
 
         vsnprintf(buffer, sizeof(buffer), format, ap);
-        char_array_0(buffer);
 
         return log_dispatch(level, error, file, line, func, object_field, object, buffer);
 }
@@ -749,7 +743,6 @@ static void log_assert(
         snprintf(buffer, sizeof(buffer), format, text, file, line, func);
         REENABLE_WARNING;
 
-        char_array_0(buffer);
         log_abort_msg = buffer;
 
         log_dispatch(level, 0, file, line, func, NULL, NULL, buffer);
@@ -875,7 +868,6 @@ int log_struct_internal(
                 va_copy(aq, ap);
                 vsnprintf(buf, sizeof(buf), format, aq);
                 va_end(aq);
-                char_array_0(buf);
 
                 if (startswith(buf, "MESSAGE=")) {
                         found = true;
diff --git a/src/shared/spawn-polkit-agent.c b/src/shared/spawn-polkit-agent.c
index e7419b5ee4..006ad532ba 100644
--- a/src/shared/spawn-polkit-agent.c
+++ b/src/shared/spawn-polkit-agent.c
@@ -39,7 +39,7 @@ static pid_t agent_pid = 0;
 int polkit_agent_open(void) {
         int r;
         int pipe_fd[2];
-        char notify_fd[10 + 1];
+        char notify_fd[DECIMAL_STR_MAX(int) + 1];
 
         if (agent_pid > 0)
                 return 0;
@@ -52,8 +52,7 @@ int polkit_agent_open(void) {
         if (pipe2(pipe_fd, 0) < 0)
                 return -errno;
 
-        snprintf(notify_fd, sizeof(notify_fd), "%i", pipe_fd[1]);
-        char_array_0(notify_fd);
+        xsprintf(notify_fd, "%i", pipe_fd[1]);
 
         r = fork_agent(&agent_pid,
                        &pipe_fd[1], 1,
diff --git a/src/shared/switch-root.c b/src/shared/switch-root.c
index ca3875628a..e8cedc69cc 100644
--- a/src/shared/switch-root.c
+++ b/src/shared/switch-root.c
@@ -72,7 +72,6 @@ int switch_root(const char *new_root, const char *oldroot, bool detach_oldroot,
                 struct stat sb;
 
                 snprintf(new_mount, sizeof(new_mount), "%s%s", new_root, i);
-                char_array_0(new_mount);
 
                 mkdir_p_label(new_mount, 0755);
 
diff --git a/src/shared/util.h b/src/shared/util.h
index ca0c2e5e3d..5312422134 100644
--- a/src/shared/util.h
+++ b/src/shared/util.h
@@ -481,6 +481,8 @@ cpu_set_t* cpu_set_malloc(unsigned *ncpus);
 int status_vprintf(const char *status, bool ellipse, bool ephemeral, const char *format, va_list ap) _printf_(4,0);
 int status_printf(const char *status, bool ellipse, bool ephemeral, const char *format, ...) _printf_(4,5);
 
+#define xsprintf(buf, fmt, ...) assert_se((size_t) snprintf(buf, ELEMENTSOF(buf), fmt, __VA_ARGS__) < ELEMENTSOF(buf))
+
 int fd_columns(int fd);
 unsigned columns(void);
 int fd_lines(int fd);