I checked all the previous string handling errors and most of them were

already fixed by You. However there were a few left and attached patch
should fix the rest of them.

I used StringInfo only in 2 places and both of them are inside debug
ifdefs. Only performance penalty will come from using strlen() like all
the other code does.

I also modified some of the already patched parts by changing
snprintf(buf, 2 * BUFSIZE, ... style lines to
snprintf(buf, sizeof(buf), ... where buf is an array.

Jukka Holappa

Author: bmomjian

contrib/cube/cubeparse.y

@@ -164,8 +164,9 @@ int cube_yyerror ( char *msg ) {
 
   position = parse_buffer_pos() > parse_buffer_size() ? parse_buffer_pos() - 1 : parse_buffer_pos();
 
-  sprintf(
+  snprintf(
 	  buf, 
+	  256,
 	  "%s at or before position %d, character ('%c', \\%03o), input: '%s'\n", 
 	  msg,
 	  position,

contrib/intarray/_int.c

@@ -22,6 +22,7 @@
 #include "utils/array.h"
 #include "utils/builtins.h"
 #include "storage/bufpage.h"
+#include "lib/stringinfo.h"
 
 /* number ranges for compression */
 #define MAXNUMRANGE 100
@@ -99,20 +100,19 @@ typedef char *BITVECP;
 static void
 printarr(ArrayType *a, int num)
 {
-	char		bbb[16384];
+	StringInfoData	bbb;
 	char	   *cur;
 	int			l;
 	int		   *d;
 
 	d = ARRPTR(a);
-	*bbb = '\0';
-	cur = bbb;
+	initStringInfo(&bbb);
 	for (l = 0; l < min(num, ARRNELEMS(a)); l++)
 	{
-		sprintf(cur, "%d ", d[l]);
-		cur = strchr(cur, '\0');
+		appendStringInfo(&bbb, "%d ", d[l]);
 	}
-	elog(DEBUG3, "\t\t%s", bbb);
+	elog(DEBUG3, "\t\t%s", bbb.data);
+	pfree(bbb.data);
 }
 static void
 printbitvec(BITVEC bv)
@@ -1924,7 +1924,7 @@ bqarr_in(PG_FUNCTION_ARGS) {
 	NODE *tmp;
 	int4 pos=0;
 #ifdef BS_DEBUG
-	char pbuf[16384],*cur;
+	StringInfoData	pbuf;
 #endif
 
 	state.buf = buf;
@@ -1955,16 +1955,15 @@ bqarr_in(PG_FUNCTION_ARGS) {
 	pos = query->size-1;
 	findoprnd( ptr, &pos );
 #ifdef BS_DEBUG
-	cur = pbuf;
-	*cur = '\0';
+	initStringInfo(&pbuf);
 	for( i=0;i<query->size;i++ ) {
 		if ( ptr[i].type == OPR )
-			sprintf(cur, "%c(%d) ", ptr[i].val, ptr[i].left);
+			appendStringInfo(&pbuf, "%c(%d) ", ptr[i].val, ptr[i].left);
 		else
-			sprintf(cur, "%d ", ptr[i].val );
-		cur = strchr(cur,'\0');
+			appendStringInfo(&pbuf, "%d ", ptr[i].val );
 	}
-	elog(DEBUG3,"POR: %s", pbuf);
+	elog(DEBUG3,"POR: %s", pbuf.data);
+	pfree(pbuf.data);
 #endif
 
 	PG_RETURN_POINTER( query );

contrib/seg/segparse.y

@@ -144,7 +144,7 @@ float seg_atof ( char *value ) {
   sscanf(value, "%f", &result);
 
   if ( errno ) {
-    sprintf(buf, "numeric value %s unrepresentable", value);
+    snprintf(buf, 256, "numeric value %s unrepresentable", value);
     reset_parse_buffer();     
     elog(ERROR, buf);
   }
@@ -165,8 +165,9 @@ int seg_yyerror ( char *msg ) {
 
   position = parse_buffer_pos() > parse_buffer_size() ? parse_buffer_pos() - 1 : parse_buffer_pos();
 
-  sprintf(
+  snprintf(
 	  buf, 
+	  256,
 	  "%s at or near position %d, character ('%c', \\%03o), input: '%s'\n", 
 	  msg,
 	  position,

contrib/spi/refint.c

@@ -112,7 +112,7 @@ check_primary_key(PG_FUNCTION_ARGS)
 	 * Construct ident string as TriggerName $ TriggeredRelationId and try
 	 * to find prepared execution plan.
 	 */
-	snprintf(ident, 2 * NAMEDATALEN, "%s$%u", trigger->tgname, rel->rd_id);
+	snprintf(ident, sizeof(ident), "%s$%u", trigger->tgname, rel->rd_id);
 	plan = find_plan(ident, &PPlans, &nPPlans);
 
 	/* if there is no plan then allocate argtypes for preparation */
@@ -160,10 +160,10 @@ check_primary_key(PG_FUNCTION_ARGS)
 		 * Construct query: SELECT 1 FROM _referenced_relation_ WHERE
 		 * Pkey1 = $1 [AND Pkey2 = $2 [...]]
 		 */
-		snprintf(sql, 8192, "select 1 from %s where ", relname);
+		snprintf(sql, sizeof(sql), "select 1 from %s where ", relname);
 		for (i = 0; i < nkeys; i++)
 		{
-			snprintf(sql + strlen(sql), 8192 - strlen(sql), "%s = $%d %s",
+			snprintf(sql + strlen(sql), sizeof(sql) - strlen(sql), "%s = $%d %s",
 			  args[i + nkeys + 1], i + 1, (i < nkeys - 1) ? "and " : "");
 		}
 
@@ -320,7 +320,7 @@ check_foreign_key(PG_FUNCTION_ARGS)
 	 * Construct ident string as TriggerName $ TriggeredRelationId and try
 	 * to find prepared execution plan(s).
 	 */
-	snprintf(ident, 2 * NAMEDATALEN, "%s$%u", trigger->tgname, rel->rd_id);
+	snprintf(ident, sizeof(ident), "%s$%u", trigger->tgname, rel->rd_id);
 	plan = find_plan(ident, &FPlans, &nFPlans);
 
 	/* if there is no plan(s) then allocate argtypes for preparation */
@@ -411,7 +411,7 @@ check_foreign_key(PG_FUNCTION_ARGS)
 			 */
 			if (action == 'r')
 
-				snprintf(sql, 8192, "select 1 from %s where ", relname);
+				snprintf(sql, sizeof(sql), "select 1 from %s where ", relname);
 
 			/*---------
 			 * For 'C'ascade action we construct DELETE query
@@ -438,7 +438,7 @@ check_foreign_key(PG_FUNCTION_ARGS)
 					char	   *nv;
 					int			k;
 
-					snprintf(sql, 8192, "update %s set ", relname);
+					snprintf(sql, sizeof(sql), "update %s set ", relname);
 					for (k = 1; k <= nkeys; k++)
 					{
 						int			is_char_type = 0;
@@ -461,7 +461,7 @@ check_foreign_key(PG_FUNCTION_ARGS)
 						 * is_char_type =1 i set ' ' for define a new
 						 * value
 						 */
-						snprintf(sql + strlen(sql), 8192 - strlen(sql),
+						snprintf(sql + strlen(sql), sizeof(sql) - strlen(sql),
 								" %s = %s%s%s %s ",
 								args2[k], (is_char_type > 0) ? "'" : "",
 								nv, (is_char_type > 0) ? "'" : "", (k < nkeys) ? ", " : "");
@@ -472,7 +472,7 @@ check_foreign_key(PG_FUNCTION_ARGS)
 				}
 				else
 /* DELETE */
-					snprintf(sql, 8192, "delete from %s where ", relname);
+					snprintf(sql, sizeof(sql), "delete from %s where ", relname);
 
 			}
 
@@ -484,10 +484,10 @@ check_foreign_key(PG_FUNCTION_ARGS)
 			 */
 			else if (action == 's')
 			{
-				snprintf(sql, 8192, "update %s set ", relname);
+				snprintf(sql, sizeof(sql), "update %s set ", relname);
 				for (i = 1; i <= nkeys; i++)
 				{
-					snprintf(sql + strlen(sql), 8192 - strlen(sql),
+					snprintf(sql + strlen(sql), sizeof(sql) - strlen(sql),
 							"%s = null%s",
 							args2[i], (i < nkeys) ? ", " : "");
 				}
@@ -497,7 +497,7 @@ check_foreign_key(PG_FUNCTION_ARGS)
 			/* Construct WHERE qual */
 			for (i = 1; i <= nkeys; i++)
 			{
-				snprintf(sql + strlen(sql), 8192 - strlen(sql), "%s = $%d %s",
+				snprintf(sql + strlen(sql), sizeof(sql) - strlen(sql), "%s = $%d %s",
 						args2[i], i, (i < nkeys) ? "and " : "");
 			}
 
@@ -547,7 +547,7 @@ check_foreign_key(PG_FUNCTION_ARGS)
 
 		relname = args[0];
 
-		snprintf(ident, 2 * NAMEDATALEN, "%s$%u", trigger->tgname, rel->rd_id);
+		snprintf(ident, sizeof(ident), "%s$%u", trigger->tgname, rel->rd_id);
 		plan = find_plan(ident, &FPlans, &nFPlans);
 		ret = SPI_execp(plan->splan[r], kvals, NULL, tcount);
 		/* we have no NULLs - so we pass   ^^^^  here */

contrib/spi/timetravel.c

@@ -250,7 +250,7 @@ timetravel(PG_FUNCTION_ARGS)
 	 * Construct ident string as TriggerName $ TriggeredRelationId and try
 	 * to find prepared execution plan.
 	 */
-	snprintf(ident, 2 * NAMEDATALEN, "%s$%u", trigger->tgname, rel->rd_id);
+	snprintf(ident, sizeof(ident), "%s$%u", trigger->tgname, rel->rd_id);
 	plan = find_plan(ident, &Plans, &nPlans);
 
 	/* if there is no plan ... */
@@ -266,10 +266,10 @@ timetravel(PG_FUNCTION_ARGS)
 		/*
 		 * Construct query: INSERT INTO _relation_ VALUES ($1, ...)
 		 */
-		snprintf(sql, 8192, "INSERT INTO %s VALUES (", relname);
+		snprintf(sql, sizeof(sql), "INSERT INTO %s VALUES (", relname);
 		for (i = 1; i <= natts; i++)
 		{
-			snprintf(sql + strlen(sql), 8192 - strlen(sql), "$%d%s",
+			snprintf(sql + strlen(sql), sizeof(sql) - strlen(sql), "$%d%s",
 					i, (i < natts) ? ", " : ")");
 			ctypes[i - 1] = SPI_gettypeid(tupdesc, i);
 		}

doc/src/sgml/spi.sgml

@@ -1,5 +1,5 @@
 <!--
-$Header: /cvsroot/pgsql/doc/src/sgml/spi.sgml,v 1.22 2002/03/22 19:20:30 petere Exp $
+$Header: /cvsroot/pgsql/doc/src/sgml/spi.sgml,v 1.23 2002/09/02 06:11:42 momjian Exp $
 -->
 
 <Chapter id="spi">
@@ -3815,7 +3815,7 @@ execq(text *sql, int cnt)
             HeapTuple tuple = tuptable->vals[j];
 
             for (i = 1, buf[0] = 0; i <= tupdesc->natts; i++)
-                sprintf(buf + strlen (buf), " %s%s",
+                snprintf(buf + strlen (buf), sizeof(buf) - strlen(buf)," %s%s",
                         SPI_getvalue(tuple, tupdesc, i),
                         (i == tupdesc->natts) ? " " : " |");
             elog (INFO, "EXECQ: %s", buf);

src/backend/parser/analyze.c

@@ -6,7 +6,7 @@
  * Portions Copyright (c) 1996-2002, PostgreSQL Global Development Group
  * Portions Copyright (c) 1994, Regents of the University of California
  *
- *	$Header: /cvsroot/pgsql/src/backend/parser/analyze.c,v 1.246 2002/08/29 07:22:22 ishii Exp $
+ *	$Header: /cvsroot/pgsql/src/backend/parser/analyze.c,v 1.247 2002/09/02 06:11:42 momjian Exp $
  *
  *-------------------------------------------------------------------------
  */
@@ -2153,7 +2153,7 @@ transformSetOperationTree(ParseState *pstate, SelectStmt *stmt)
 		/*
 		 * Make the leaf query be a subquery in the top-level rangetable.
 		 */
-		snprintf(selectName, 32, "*SELECT* %d", length(pstate->p_rtable) + 1);
+		snprintf(selectName, sizeof(selectName), "*SELECT* %d", length(pstate->p_rtable) + 1);
 		rte = addRangeTableEntryForSubquery(pstate,
 											selectQuery,
 											makeAlias(selectName, NIL),

src/backend/storage/file/fd.c

@@ -7,7 +7,7 @@
  * Portions Copyright (c) 1994, Regents of the University of California
  *
  * IDENTIFICATION
- *	  $Header: /cvsroot/pgsql/src/backend/storage/file/fd.c,v 1.94 2002/09/02 02:47:03 momjian Exp $
+ *	  $Header: /cvsroot/pgsql/src/backend/storage/file/fd.c,v 1.95 2002/09/02 06:11:42 momjian Exp $
  *
  * NOTES:
  *
@@ -344,14 +344,14 @@ _dump_lru(void)
 	Vfd		   *vfdP = &VfdCache[mru];
 	char		buf[2048];
 
-	sprintf(buf, "LRU: MOST %d ", mru);
+	snprintf(buf, sizeof(buf), "LRU: MOST %d ", mru);
 	while (mru != 0)
 	{
 		mru = vfdP->lruLessRecently;
 		vfdP = &VfdCache[mru];
-		sprintf(buf + strlen(buf), "%d ", mru);
+		snprintf(buf + strlen(buf), sizeof(buf) - strlen(buf), "%d ", mru);
 	}
-	sprintf(buf + strlen(buf), "LEAST");
+	snprintf(buf + strlen(buf), sizeof(buf) - strlen(buf), "LEAST");
 	elog(LOG, buf);
 }
 #endif   /* FDDEBUG */