Avoid using unsafe sprintf()

Author: alexandre-daubois

Zend/zend_alloc.c

@@ -386,7 +386,7 @@ ZEND_COLD void zend_debug_alloc_output(char *format, ...)
 	va_list args;
 
 	va_start(args, format);
-	vsprintf(output_buf, format, args);
+	vsnprintf(output_buf, sizeof(output_buf), format, args);
 	va_end(args);
 
 #ifdef ZEND_WIN32

ext/pdo_firebird/firebird_statement.c

@@ -100,7 +100,7 @@ static int get_formatted_time_tz(pdo_stmt_t *stmt, const ISC_TIME_TZ* timeTz, zv
 		return 1;
 	}
 
-	size_t time_tz_len = sprintf(timeTzBuf, "%s %s", timeBuf, timeZoneBuffer);
+	size_t time_tz_len = snprintf(timeTzBuf, sizeof(timeTzBuf), "%s %s", timeBuf, timeZoneBuffer);
 	ZVAL_STRINGL(result, timeTzBuf, time_tz_len);
 	return 0;
 }
@@ -130,7 +130,7 @@ static int get_formatted_timestamp_tz(pdo_stmt_t *stmt, const ISC_TIMESTAMP_TZ*
 		return 1;
 	}
 
-	size_t timestamp_tz_len = sprintf(timestampTzBuf, "%s %s", timestampBuf, timeZoneBuffer);
+	size_t timestamp_tz_len = snprintf(timestampTzBuf, sizeof(timestampTzBuf), "%s %s", timestampBuf, timeZoneBuffer);
 	ZVAL_STRINGL(result, timestampTzBuf, timestamp_tz_len);
 	return 0;
 }

sapi/fpm/fpm/fpm_sockets.c

@@ -90,7 +90,10 @@ static void fpm_sockets_cleanup(int which, void *arg) /* {{{ */
 				}
 			}
 
-			p += sprintf(env_value + p + socket_set_buf, "%s%s=%s", (p && !socket_set_buf) ? "," : "", ls->key, fd);
+			int written = snprintf(env_value + p + socket_set_buf, 
+				strlen(ls->key) + strlen(fd) + 2 + (p && !socket_set_buf ? 1 : 0), 
+				"%s%s=%s", (p && !socket_set_buf) ? "," : "", ls->key, fd);
+			p += written;
 			p += socket_set_buf;
 		}