I checked all the previous string handling errors and most of them were

already fixed by You. However there were a few left and attached patch
should fix the rest of them.

I used StringInfo only in 2 places and both of them are inside debug
ifdefs. Only performance penalty will come from using strlen() like all
the other code does.

I also modified some of the already patched parts by changing
snprintf(buf, 2 * BUFSIZE, ... style lines to
snprintf(buf, sizeof(buf), ... where buf is an array.

Jukka Holappa

5 files changed, 32 insertions, 31 deletions

diff --git a/contrib/cube/cubeparse.y b/contrib/cube/cubeparse.y
index accad12511..887528eb03 100644
--- a/contrib/cube/cubeparse.y
+++ b/contrib/cube/cubeparse.y
@@ -164,8 +164,9 @@ int cube_yyerror ( char *msg ) {
 
   position = parse_buffer_pos() > parse_buffer_size() ? parse_buffer_pos() - 1 : parse_buffer_pos();
 
-  sprintf(
+  snprintf(
 	  buf, 
+	  256,
 	  "%s at or before position %d, character ('%c', \\%03o), input: '%s'\n", 
 	  msg,
 	  position,
diff --git a/contrib/intarray/_int.c b/contrib/intarray/_int.c
index 1c0de0bce8..75ebf5d8dd 100644
--- a/contrib/intarray/_int.c
+++ b/contrib/intarray/_int.c
@@ -22,6 +22,7 @@
 #include "utils/array.h"
 #include "utils/builtins.h"
 #include "storage/bufpage.h"
+#include "lib/stringinfo.h"
 
 /* number ranges for compression */
 #define MAXNUMRANGE 100
@@ -99,20 +100,19 @@ typedef char *BITVECP;
 static void
 printarr(ArrayType *a, int num)
 {
-	char		bbb[16384];
+	StringInfoData	bbb;
 	char	   *cur;
 	int			l;
 	int		   *d;
 
 	d = ARRPTR(a);
-	*bbb = '\0';
-	cur = bbb;
+	initStringInfo(&bbb);
 	for (l = 0; l < min(num, ARRNELEMS(a)); l++)
 	{
-		sprintf(cur, "%d ", d[l]);
-		cur = strchr(cur, '\0');
+		appendStringInfo(&bbb, "%d ", d[l]);
 	}
-	elog(DEBUG3, "\t\t%s", bbb);
+	elog(DEBUG3, "\t\t%s", bbb.data);
+	pfree(bbb.data);
 }
 static void
 printbitvec(BITVEC bv)
@@ -1924,7 +1924,7 @@ bqarr_in(PG_FUNCTION_ARGS) {
 	NODE *tmp;
 	int4 pos=0;
 #ifdef BS_DEBUG
-	char pbuf[16384],*cur;
+	StringInfoData	pbuf;
 #endif
 
 	state.buf = buf;
@@ -1955,16 +1955,15 @@ bqarr_in(PG_FUNCTION_ARGS) {
 	pos = query->size-1;
 	findoprnd( ptr, &pos );
 #ifdef BS_DEBUG
-	cur = pbuf;
-	*cur = '\0';
+	initStringInfo(&pbuf);
 	for( i=0;i<query->size;i++ ) {
 		if ( ptr[i].type == OPR )
-			sprintf(cur, "%c(%d) ", ptr[i].val, ptr[i].left);
+			appendStringInfo(&pbuf, "%c(%d) ", ptr[i].val, ptr[i].left);
 		else
-			sprintf(cur, "%d ", ptr[i].val );
-		cur = strchr(cur,'\0');
+			appendStringInfo(&pbuf, "%d ", ptr[i].val );
 	}
-	elog(DEBUG3,"POR: %s", pbuf);
+	elog(DEBUG3,"POR: %s", pbuf.data);
+	pfree(pbuf.data);
 #endif
 
 	PG_RETURN_POINTER( query );
diff --git a/contrib/seg/segparse.y b/contrib/seg/segparse.y
index 10a4227c19..3ffcbff417 100644
--- a/contrib/seg/segparse.y
+++ b/contrib/seg/segparse.y
@@ -144,7 +144,7 @@ float seg_atof ( char *value ) {
   sscanf(value, "%f", &result);
 
   if ( errno ) {
-    sprintf(buf, "numeric value %s unrepresentable", value);
+    snprintf(buf, 256, "numeric value %s unrepresentable", value);
     reset_parse_buffer();     
     elog(ERROR, buf);
   }
@@ -165,8 +165,9 @@ int seg_yyerror ( char *msg ) {
 
   position = parse_buffer_pos() > parse_buffer_size() ? parse_buffer_pos() - 1 : parse_buffer_pos();
 
-  sprintf(
+  snprintf(
 	  buf, 
+	  256,
 	  "%s at or near position %d, character ('%c', \\%03o), input: '%s'\n", 
 	  msg,
 	  position,
diff --git a/contrib/spi/refint.c b/contrib/spi/refint.c
index 6355763f94..e1688c98a1 100644
--- a/contrib/spi/refint.c
+++ b/contrib/spi/refint.c
@@ -112,7 +112,7 @@ check_primary_key(PG_FUNCTION_ARGS)
 	 * Construct ident string as TriggerName $ TriggeredRelationId and try
 	 * to find prepared execution plan.
 	 */
-	snprintf(ident, 2 * NAMEDATALEN, "%s$%u", trigger->tgname, rel->rd_id);
+	snprintf(ident, sizeof(ident), "%s$%u", trigger->tgname, rel->rd_id);
 	plan = find_plan(ident, &PPlans, &nPPlans);
 
 	/* if there is no plan then allocate argtypes for preparation */
@@ -160,10 +160,10 @@ check_primary_key(PG_FUNCTION_ARGS)
 		 * Construct query: SELECT 1 FROM _referenced_relation_ WHERE
 		 * Pkey1 = $1 [AND Pkey2 = $2 [...]]
 		 */
-		snprintf(sql, 8192, "select 1 from %s where ", relname);
+		snprintf(sql, sizeof(sql), "select 1 from %s where ", relname);
 		for (i = 0; i < nkeys; i++)
 		{
-			snprintf(sql + strlen(sql), 8192 - strlen(sql), "%s = $%d %s",
+			snprintf(sql + strlen(sql), sizeof(sql) - strlen(sql), "%s = $%d %s",
 			  args[i + nkeys + 1], i + 1, (i < nkeys - 1) ? "and " : "");
 		}
 
@@ -320,7 +320,7 @@ check_foreign_key(PG_FUNCTION_ARGS)
 	 * Construct ident string as TriggerName $ TriggeredRelationId and try
 	 * to find prepared execution plan(s).
 	 */
-	snprintf(ident, 2 * NAMEDATALEN, "%s$%u", trigger->tgname, rel->rd_id);
+	snprintf(ident, sizeof(ident), "%s$%u", trigger->tgname, rel->rd_id);
 	plan = find_plan(ident, &FPlans, &nFPlans);
 
 	/* if there is no plan(s) then allocate argtypes for preparation */
@@ -411,7 +411,7 @@ check_foreign_key(PG_FUNCTION_ARGS)
 			 */
 			if (action == 'r')
 
-				snprintf(sql, 8192, "select 1 from %s where ", relname);
+				snprintf(sql, sizeof(sql), "select 1 from %s where ", relname);
 
 			/*---------
 			 * For 'C'ascade action we construct DELETE query
@@ -438,7 +438,7 @@ check_foreign_key(PG_FUNCTION_ARGS)
 					char	   *nv;
 					int			k;
 
-					snprintf(sql, 8192, "update %s set ", relname);
+					snprintf(sql, sizeof(sql), "update %s set ", relname);
 					for (k = 1; k <= nkeys; k++)
 					{
 						int			is_char_type = 0;
@@ -461,7 +461,7 @@ check_foreign_key(PG_FUNCTION_ARGS)
 						 * is_char_type =1 i set ' ' for define a new
 						 * value
 						 */
-						snprintf(sql + strlen(sql), 8192 - strlen(sql),
+						snprintf(sql + strlen(sql), sizeof(sql) - strlen(sql),
 								" %s = %s%s%s %s ",
 								args2[k], (is_char_type > 0) ? "'" : "",
 								nv, (is_char_type > 0) ? "'" : "", (k < nkeys) ? ", " : "");
@@ -472,7 +472,7 @@ check_foreign_key(PG_FUNCTION_ARGS)
 				}
 				else
 /* DELETE */
-					snprintf(sql, 8192, "delete from %s where ", relname);
+					snprintf(sql, sizeof(sql), "delete from %s where ", relname);
 
 			}
 
@@ -484,10 +484,10 @@ check_foreign_key(PG_FUNCTION_ARGS)
 			 */
 			else if (action == 's')
 			{
-				snprintf(sql, 8192, "update %s set ", relname);
+				snprintf(sql, sizeof(sql), "update %s set ", relname);
 				for (i = 1; i <= nkeys; i++)
 				{
-					snprintf(sql + strlen(sql), 8192 - strlen(sql),
+					snprintf(sql + strlen(sql), sizeof(sql) - strlen(sql),
 							"%s = null%s",
 							args2[i], (i < nkeys) ? ", " : "");
 				}
@@ -497,7 +497,7 @@ check_foreign_key(PG_FUNCTION_ARGS)
 			/* Construct WHERE qual */
 			for (i = 1; i <= nkeys; i++)
 			{
-				snprintf(sql + strlen(sql), 8192 - strlen(sql), "%s = $%d %s",
+				snprintf(sql + strlen(sql), sizeof(sql) - strlen(sql), "%s = $%d %s",
 						args2[i], i, (i < nkeys) ? "and " : "");
 			}
 
@@ -547,7 +547,7 @@ check_foreign_key(PG_FUNCTION_ARGS)
 
 		relname = args[0];
 
-		snprintf(ident, 2 * NAMEDATALEN, "%s$%u", trigger->tgname, rel->rd_id);
+		snprintf(ident, sizeof(ident), "%s$%u", trigger->tgname, rel->rd_id);
 		plan = find_plan(ident, &FPlans, &nFPlans);
 		ret = SPI_execp(plan->splan[r], kvals, NULL, tcount);
 		/* we have no NULLs - so we pass   ^^^^  here */
diff --git a/contrib/spi/timetravel.c b/contrib/spi/timetravel.c
index 7bd30c109f..771e9248b8 100644
--- a/contrib/spi/timetravel.c
+++ b/contrib/spi/timetravel.c
@@ -250,7 +250,7 @@ timetravel(PG_FUNCTION_ARGS)
 	 * Construct ident string as TriggerName $ TriggeredRelationId and try
 	 * to find prepared execution plan.
 	 */
-	snprintf(ident, 2 * NAMEDATALEN, "%s$%u", trigger->tgname, rel->rd_id);
+	snprintf(ident, sizeof(ident), "%s$%u", trigger->tgname, rel->rd_id);
 	plan = find_plan(ident, &Plans, &nPlans);
 
 	/* if there is no plan ... */
@@ -266,10 +266,10 @@ timetravel(PG_FUNCTION_ARGS)
 		/*
 		 * Construct query: INSERT INTO _relation_ VALUES ($1, ...)
 		 */
-		snprintf(sql, 8192, "INSERT INTO %s VALUES (", relname);
+		snprintf(sql, sizeof(sql), "INSERT INTO %s VALUES (", relname);
 		for (i = 1; i <= natts; i++)
 		{
-			snprintf(sql + strlen(sql), 8192 - strlen(sql), "$%d%s",
+			snprintf(sql + strlen(sql), sizeof(sql) - strlen(sql), "$%d%s",
 					i, (i < natts) ? ", " : ")");
 			ctypes[i - 1] = SPI_gettypeid(tupdesc, i);
 		}