utils: replace sprintf use with snprintf to avoid overflows

Signed-off-by: Felix Fietkau <nbd@nbd.name>

diff --git a/utils.c b/utils.c
index 537c62980fc354a75ea848268fa26640561f8bbd..875a141cc44fa2e2efb51ca8f3da673d77a5b1d6 100644 (file)
--- a/utils.c
+++ b/utils.c
@@ -485,18 +485,21 @@ write_zone_uci(struct uci_context *ctx, struct fw3_zone *z,
 
        fw3_foreach(dev, &z->devices)
        {
+               char *ep;
+
                if (!dev)
                        continue;
 
                p = buf;
+               ep = buf + sizeof(buf);
 
                if (dev->invert)
-                       p += sprintf(p, "!");
+                       p += snprintf(p, ep - p, "!");
 
                if (*dev->network)
-                       p += sprintf(p, "%s@%s", dev->name, dev->network);
+                       p += snprintf(p, ep - p, "%s@%s", dev->name, dev->network);
                else
-                       p += sprintf(p, "%s", dev->name);
+                       p += snprintf(p, ep - p, "%s", dev->name);
 
                ptr.value = buf;
                uci_add_list(ctx, &ptr);