Replace sprintf() by snprintf().

src/Afterburner.c

@@ -1714,7 +1714,7 @@ void after_postcntl(struct Control *globs, struct Variable *vars)
   char histstring[99];
   int datatype;
 
-  sprintf(histstring, "afterburner version %s  type = %d", VERSION, globs->Type);
+  snprintf(histstring, sizeof(histstring), "afterburner version %s  type = %d", VERSION, globs->Type);
 
 #if defined(AFTERBURNER)
   afterInqHistory(globs->istreamID);

src/CDIread.c

@@ -46,7 +46,7 @@ const char *datatypestr(int datatype)
   static char str[20];
 
   str[0] = 0;
-  sprintf(str, "%d bit packed", datatype);
+  snprintf(str, sizeof(str), "%d bit packed", datatype);
 
   if      ( datatype == CDI_DATATYPE_PACK   ) return ("P0");
   else if ( datatype > 0 && datatype <= 32 ) return (str);
@@ -171,7 +171,7 @@ void *CDIread(void *argument)
 
       file_size = (double) fileSize(cdoStreamName(0)->args);
 
-      if ( nruns > 1 ) sprintf(sinfo, "(run %d)", irun+1);
+      if ( nruns > 1 ) snprintf(sinfo, sizeof(sinfo), "(run %d)", irun+1);
 
       print_stat(sinfo, memtype, datatype, filetype, nvalues, data_size, file_size, tw);
     }

src/CDIwrite.c

@@ -47,7 +47,7 @@ const char *datatypestr(int datatype)
   static char str[20];
 
   str[0] = 0;
-  sprintf(str, "%d bit packed", datatype);
+  snprintf(str, sizeof(str), "%d bit packed", datatype);
 
   if      ( datatype == CDI_DATATYPE_PACK   ) return ("P0");
   else if ( datatype > 0 && datatype <= 32 ) return (str);
@@ -272,7 +272,7 @@ void *CDIwrite(void *argument)
 
       file_size = (double) fileSize(cdoStreamName(0)->args);
 
-      if ( nruns > 1 ) sprintf(sinfo, "(run %d)", irun+1);
+      if ( nruns > 1 ) snprintf(sinfo, sizeof(sinfo), "(run %d)", irun+1);
 
       print_stat(sinfo, memtype, datatype, filetype, nvalues, data_size, file_size, tw);
     }

src/CMOR.c

@@ -136,8 +136,9 @@ static char *get_val(struct kv **ht, char *key, char *def)
 static char *key_rename(struct kv **ht, char *word)
 {
   struct kv *e;
-  char *key = (char *) Malloc(strlen(word) + 12);
-  sprintf(key, "__rename_%s", word);
+  size_t len = strlen(word) + 12;
+  char *key = (char *) Malloc(len);
+  snprintf(key, len, "__rename_%s", word);
   HASH_FIND_STR(*ht, key, e);
   Free(key);
   return e ? e->value : word;
@@ -532,7 +533,7 @@ static void get_taxis_units(char *units, int taxisID)
        timeunit == TUNIT_12HOURS )
     timeunit = TUNIT_HOUR;
 
-  sprintf(units, "%s since %d-%d-%d %02d:%02d:%02d", tunitNamePtr(timeunit),
+  snprintf(units, CMOR_MAX_STRING, "%s since %d-%d-%d %02d:%02d:%02d", tunitNamePtr(timeunit),
           year, month, day, hour, minute, second);
 }
 

src/FC.c

@@ -204,7 +204,7 @@ void *FC(void *argument)
 	  if ( gridIDgp == -1 )
 	    {
 	      char gridname[20];
-	      sprintf(gridname, "t%dgrid", ntr);
+	      snprintf(gridname, sizeof(gridname), "t%dgrid", ntr);
 
 	      gridIDgp = gridFromName(gridname);
 	    }

src/Gradsdes.c

@@ -1356,8 +1356,8 @@ void *Gradsdes(void *argument)
         }
     }
 
-  sprintf(Time, "%02d:%02dZ%02d%s%04d", ihh0, imn0, idd0, cmons[imm0-1], iyy0);
-  sprintf(Incr, "%d%s", dt, IncrKey[iik]);
+  snprintf(Time, sizeof(Time), "%02d:%02dZ%02d%s%04d", ihh0, imn0, idd0, cmons[imm0-1], iyy0);
+  snprintf(Incr, sizeof(Incr), "%d%s", dt, IncrKey[iik]);
 
   fprintf(gdp, "TDEF %d LINEAR %s %s\n", tsID, Time, Incr);
 

src/Remap.c

@@ -186,22 +186,22 @@ void print_remap_info(int operfunc, int remap_genweights, remapgrid_t *src_grid,
 
   strcat(line, gridNamePtr(gridInqType(src_grid->gridID)));
   if ( src_grid->rank == 2 )
-    sprintf(tmpstr, " (%dx%d)", src_grid->dims[0], src_grid->dims[1]);
+    snprintf(tmpstr, sizeof(tmpstr), " (%dx%d)", src_grid->dims[0], src_grid->dims[1]);
   else
-    sprintf(tmpstr, " (%d)", src_grid->dims[0]);
+    snprintf(tmpstr, sizeof(tmpstr), " (%d)", src_grid->dims[0]);
   strcat(line, tmpstr);
   strcat(line, " to ");
   strcat(line, gridNamePtr(gridInqType(tgt_grid->gridID)));
   if ( tgt_grid->rank == 2 )
-    sprintf(tmpstr, " (%dx%d)", tgt_grid->dims[0], tgt_grid->dims[1]);
+    snprintf(tmpstr, sizeof(tmpstr), " (%dx%d)", tgt_grid->dims[0], tgt_grid->dims[1]);
   else
-    sprintf(tmpstr, " (%d)", tgt_grid->dims[0]);
+    snprintf(tmpstr, sizeof(tmpstr), " (%d)", tgt_grid->dims[0]);
   strcat(line, tmpstr);
   strcat(line, " grid");
 
   if ( nmiss > 0 )
     {
-      sprintf(tmpstr, ", with source mask (%d)", gridInqSize(src_grid->gridID)-nmiss);
+      snprintf(tmpstr, sizeof(tmpstr), ", with source mask (%d)", gridInqSize(src_grid->gridID)-nmiss);
       strcat(line, tmpstr);
     }
 
@@ -234,15 +234,15 @@ void print_remap_warning(const char *remap_file, int operfunc, remapgrid_t *src_
   strcat(line, " not used, ");
   strcat(line, gridNamePtr(gridInqType(src_grid->gridID)));
   if ( src_grid->rank == 2 )
-    sprintf(tmpstr, " (%dx%d)", src_grid->dims[0], src_grid->dims[1]);
+    snprintf(tmpstr, sizeof(tmpstr), " (%dx%d)", src_grid->dims[0], src_grid->dims[1]);
   else
-    sprintf(tmpstr, " (%d)", src_grid->dims[0]);
+    snprintf(tmpstr, sizeof(tmpstr), " (%d)", src_grid->dims[0]);
   strcat(line, tmpstr);
   strcat(line, " grid");
 
   if ( nmiss > 0 )
     {
-      sprintf(tmpstr, " with mask (%d)", gridInqSize(src_grid->gridID)-nmiss);
+      snprintf(tmpstr, sizeof(tmpstr), " with mask (%d)", gridInqSize(src_grid->gridID)-nmiss);
       strcat(line, tmpstr);
     }
 

src/Spectral.c

@@ -157,9 +157,9 @@ void *Spectral(void *argument)
 	    {
 	      char gridname[20];
 	      if ( operatorID == SP2GP )
-		sprintf(gridname, "t%dgrid", gridInqTrunc(gridIDsp));
+		snprintf(gridname, sizeof(gridname), "t%dgrid", gridInqTrunc(gridIDsp));
 	      else
-		sprintf(gridname, "tl%dgrid", gridInqTrunc(gridIDsp));
+		snprintf(gridname, sizeof(gridname), "tl%dgrid", gridInqTrunc(gridIDsp));
 
 	      gridIDgp = gridFromName(gridname);
 	    }

src/Wind.c

@@ -235,9 +235,9 @@ void *Wind(void *argument)
 	      char gridname[20];
 
 	      if ( operatorID == DV2UV )
-		sprintf(gridname, "t%dgrid", gridInqTrunc(gridIDsp));
+		snprintf(gridname, sizeof(gridname), "t%dgrid", gridInqTrunc(gridIDsp));
 	      else
-		sprintf(gridname, "tl%dgrid", gridInqTrunc(gridIDsp));
+		snprintf(gridname, sizeof(gridname), "tl%dgrid", gridInqTrunc(gridIDsp));
 	  
 	      gridIDgp = gridFromName(gridname);
 	    }

src/afterburnerlib.c

@@ -34,7 +34,7 @@ char *FieldName(int code, const char *text)
 {
   static char name[256];
 
-  sprintf(name, "[%3d].%s", code, text);
+  snprintf(name, sizeof(name), "[%3d].%s", code, text);
 
   return name;
 }

src/parse_cmor_table.c

@@ -195,16 +195,18 @@ int dump_json(const char *js, jsmntok_t *t, size_t count, int level)
 static
 void kvlist_append_json(list_t *kvl, const char *key, const char *js, jsmntok_t *t, int nvalues)
 {
-  char name[1024];
   keyValues_t *keyval = (keyValues_t *) malloc(sizeof(keyValues_t));
   keyval->key = strdup(key);
   keyval->nvalues = nvalues;
   keyval->values = (char **) malloc(nvalues*sizeof(char*));
   for ( int i = 0; i < nvalues; ++i )
     {
-      sprintf(name, "%.*s", t[i].end - t[i].start, js+t[i].start);
-      // printf("set %s: '%s'\n", key, name);
-      keyval->values[i] = strdup(name);
+      size_t len = t[i].end - t[i].start;
+      char *value = (char*) malloc((len+1)*sizeof(char));
+      snprintf(value, len+1, "%.*s", (int)len, js+t[i].start);
+      value[len] = 0;
+      // printf("set %s: '%s'\n", key, value);
+      keyval->values[i] = value;
     }
   list_append(kvl, &keyval);
 }
@@ -213,7 +215,7 @@ static
 int json_to_pml(list_t *pml, const char *js, jsmntok_t *t, int count)
 {
   bool debug = false;
-  char name[1024];
+  char name[4096];
   list_t *kvl = NULL;
   int pmlname = -1;
   int i = 0;
@@ -228,7 +230,8 @@ int json_to_pml(list_t *pml, const char *js, jsmntok_t *t, int count)
           {
             int ic = 0;
           NEXT:
-            sprintf(name, "%.*s", t[pmlname].end - t[pmlname].start, js+t[pmlname].start);
+            snprintf(name, sizeof(name), "%.*s", t[pmlname].end - t[pmlname].start, js+t[pmlname].start);
+            name[sizeof(name)-1] = 0;
             // printf("new object: %s\n", name);
             kvl = list_new(sizeof(keyValues_t *), free_keyval, name);
             list_append(pml, &kvl);
@@ -247,7 +250,8 @@ int json_to_pml(list_t *pml, const char *js, jsmntok_t *t, int count)
             for ( int jb = 0; jb < n; ++jb )
               {
                 ++i;
-                sprintf(name, "%.*s", t[i].end - t[i].start, js+t[i].start);
+                snprintf(name, sizeof(name), "%.*s", t[i].end - t[i].start, js+t[i].start);
+                name[sizeof(name)-1] = 0;
                 if ( debug ) printf("    %.*s:", t[i].end - t[i].start, js+t[i].start);
                 ++i;
                 if ( t[i].type == JSMN_ARRAY )

src/pstream.c

@@ -291,7 +291,8 @@ void pstreamOpenReadPipe(const argument_t *argument, pstream_t *pstreamptr)
 #if defined(HAVE_LIBPTHREAD)
   int pstreamID = pstreamptr->self;
 
-  char *pipename = (char*) Malloc(16);
+  size_t pnlen = 16;
+  char *pipename = (char*) Malloc(pnlen);
   // struct sched_param param;
   
   argument_t *newargument = (argument_t*) Malloc(sizeof(argument_t));
@@ -303,9 +304,9 @@ void pstreamOpenReadPipe(const argument_t *argument, pstream_t *pstreamptr)
   char *operatorName = getOperatorName(operatorArg);
 
   size_t len = strlen(argument->args);
-  char *newarg = (char*) Malloc(len+16);
+  char *newarg = (char*) Malloc(len+pnlen);
   strcpy(newarg, argument->args);
-  sprintf(pipename, "(pipe%d.%d)", processSelf() + 1, processInqChildNum() + 1);
+  snprintf(pipename, pnlen, "(pipe%d.%d)", processSelf() + 1, processInqChildNum() + 1);
   newarg[len] = ' ';
   strcpy(&newarg[len+1], pipename);
 
@@ -1677,7 +1678,7 @@ void cdoFinish(void)
 	}
 
       if ( memmax )
-	sprintf(memstring, " %ld%c ", memmax, mu[muindex]);
+	snprintf(memstring, sizeof(memstring), " %ld%c ", memmax, mu[muindex]);
 
       processEndTime(&p_usertime, &p_systime);
       p_cputime  = p_usertime + p_systime;

src/util.c

@@ -623,7 +623,7 @@ int datatype2str(int datatype, char *datatypestr)
   int status = 0;
 
   if      ( datatype == CDI_DATATYPE_PACK   ) strcpy(datatypestr, "P0");
-  else if ( datatype > 0 && datatype <= 32  ) sprintf(datatypestr, "P%d", datatype);
+  else if ( datatype > 0 && datatype <= 32  ) snprintf(datatypestr, 4, "P%d", datatype);
   else if ( datatype == CDI_DATATYPE_CPX32  ) strcpy(datatypestr, "C32");
   else if ( datatype == CDI_DATATYPE_CPX64  ) strcpy(datatypestr, "C64");
   else if ( datatype == CDI_DATATYPE_FLT32  ) strcpy(datatypestr, "F32");