From 5987a7b1af09e97271be3da74d336a64435e759a Mon Sep 17 00:00:00 2001
From: Ulrich Sibiller <uli42@gmx.de>
Date: Thu, 23 Nov 2017 21:25:26 +0100
Subject: Dialog.c,Display.c,Font.c,NXdixfonts.c: don't use hardcoded string
 buffer lengths

---
 nx-X11/programs/Xserver/hw/nxagent/Dialog.c     | 17 +++++++----------
 nx-X11/programs/Xserver/hw/nxagent/Display.c    |  6 +++---
 nx-X11/programs/Xserver/hw/nxagent/Font.c       |  7 ++++---
 nx-X11/programs/Xserver/hw/nxagent/NXdixfonts.c |  8 ++++----
 4 files changed, 18 insertions(+), 20 deletions(-)

diff --git a/nx-X11/programs/Xserver/hw/nxagent/Dialog.c b/nx-X11/programs/Xserver/hw/nxagent/Dialog.c
index b7852a0ac..df6bb1c89 100644
--- a/nx-X11/programs/Xserver/hw/nxagent/Dialog.c
+++ b/nx-X11/programs/Xserver/hw/nxagent/Dialog.c
@@ -279,15 +279,15 @@ void nxagentLaunchDialog(DialogType dialogType)
 
   if (dialogType == DIALOG_FAILED_RECONNECTION)
   {
-    strncpy(dialogDisplay, nxagentDisplayName, 255);
+    strncpy(dialogDisplay, nxagentDisplayName, sizeof(dialogDisplay) - 1);
   }
   else
   {
     strcpy(dialogDisplay, ":");
-    strncat(dialogDisplay, display, 254);
+    strncat(dialogDisplay, display, sizeof(dialogDisplay) - 1 - 1);
   }
 
-  *(dialogDisplay + 255) = '\0';
+  dialogDisplay[sizeof(dialogDisplay) - 1] = '\0';
 
   /*
    * We don't want to receive SIGCHLD
@@ -308,7 +308,7 @@ void nxagentLaunchDialog(DialogType dialogType)
               DECODE_DIALOG_TYPE(dialogType), *pid, dialogDisplay);
   #endif
 
-  *dialogDisplay = '\0';
+  dialogDisplay[0] = '\0';
 
   /*
    * Restore the previous set of
@@ -320,8 +320,7 @@ void nxagentLaunchDialog(DialogType dialogType)
 
 void nxagentPulldownDialog(Window wid)
 {
-  snprintf(nxagentPulldownWindow, 15, "%ld", (long int) wid);
-  nxagentPulldownWindow[15] = 0;
+  snprintf(nxagentPulldownWindow, sizeof(nxagentPulldownWindow), "%ld", (long int) wid);
 
   #ifdef TEST
   fprintf(stderr, "nxagentPulldownDialog: Going to launch pulldown "
@@ -330,7 +329,7 @@ void nxagentPulldownDialog(Window wid)
 
   nxagentLaunchDialog(DIALOG_PULLDOWN);
 
-  nxagentPulldownWindow[0] = 0;
+  nxagentPulldownWindow[0] = '\0';
 }
 
 void nxagentFailedReconnectionDialog(int alert, char *error)
@@ -372,9 +371,7 @@ void nxagentFailedReconnectionDialog(int alert, char *error)
     int status;
     int options = 0;
 
-    snprintf(nxagentFailedReconnectionMessage, 255, "Reconnection failed: %s", error);
-
-    *(nxagentFailedReconnectionMessage + 255) = '\0';
+    snprintf(nxagentFailedReconnectionMessage, sizeof(nxagentFailedReconnectionMessage), "Reconnection failed: %s", error);
 
     nxagentLaunchDialog(DIALOG_FAILED_RECONNECTION);
 
diff --git a/nx-X11/programs/Xserver/hw/nxagent/Display.c b/nx-X11/programs/Xserver/hw/nxagent/Display.c
index 4930baee2..5943e538e 100644
--- a/nx-X11/programs/Xserver/hw/nxagent/Display.c
+++ b/nx-X11/programs/Xserver/hw/nxagent/Display.c
@@ -1150,9 +1150,9 @@ void nxagentOpenDisplay(int argc, char *argv[])
 
   if (*nxagentDisplayName == '\0')
   {
-    strncpy(nxagentDisplayName, XDisplayName(NULL), 1023);
+    strncpy(nxagentDisplayName, XDisplayName(NULL), sizeof(nxagentDisplayName) - 1);
 
-    nxagentDisplayName[1023] = '\0';
+    nxagentDisplayName[sizeof(nxagentDisplayName) - 1] = '\0';
   }
 
   nxagentCloseDisplay();
@@ -1862,7 +1862,7 @@ static FILE *nxagentLookForIconFile(char *iconName, const char *permission,
       singlePath[strlen(singlePath)- 1] = 0;
     }
 
-    if (strlen(singlePath) + strlen(iconName) + 1 < PATH_MAX)
+    if (strlen(singlePath) + strlen(iconName) + 1 < sizeof(singlePath)<)
     {
       strncat(singlePath, slash, 1);
       strcat(singlePath, iconName);
diff --git a/nx-X11/programs/Xserver/hw/nxagent/Font.c b/nx-X11/programs/Xserver/hw/nxagent/Font.c
index 3b35a8bff..c7fcaf346 100644
--- a/nx-X11/programs/Xserver/hw/nxagent/Font.c
+++ b/nx-X11/programs/Xserver/hw/nxagent/Font.c
@@ -1406,15 +1406,16 @@ Bool nxagentDisconnectAllFonts()
 
 static Bool nxagentGetFontServerPath(char * fontServerPath)
 {
-  char path[256];
+  /* ensure path is no longer than fontServerPath */
+  char path[256] = {0};
 
-  if (NXGetFontParameters(nxagentDisplay, 256, path) == True)
+  if (NXGetFontParameters(nxagentDisplay, sizeof(path), path) == True)
   {
     if (*path != '\0')
     {
       strncpy(fontServerPath, path + 1, *path);
 
-      *(fontServerPath + *path) = '\0';
+      fontServerPath[*path] = '\0';
 
       #ifdef TEST
       fprintf(stderr, "nxagentGetFontServerPath: Got path [%s].\n",
diff --git a/nx-X11/programs/Xserver/hw/nxagent/NXdixfonts.c b/nx-X11/programs/Xserver/hw/nxagent/NXdixfonts.c
index 49d864887..db555d5fc 100644
--- a/nx-X11/programs/Xserver/hw/nxagent/NXdixfonts.c
+++ b/nx-X11/programs/Xserver/hw/nxagent/NXdixfonts.c
@@ -121,7 +121,7 @@ static const char *_NXGetFontPath(const char *path)
 
     if (fontEnv != NULL && *fontEnv != '\0')
     {
-        if (strlen(fontEnv) + 1 > 1024)
+        if (strlen(fontEnv) + 1 > sizeof(_NXFontPath))
         {
 #ifdef NX_TRANS_TEST
             fprintf(stderr, "_NXGetFontPath: WARNING! Maximum length of font path exceeded.\n");
@@ -140,8 +140,8 @@ static const char *_NXGetFontPath(const char *path)
 
 _NXGetFontPathError:
 
-    strncpy(_NXFontPath, path, 1023);
-    _NXFontPath[1023] = '\0';
+    strncpy(_NXFontPath, path, sizeof(_NXFontPath) - 1);
+    _NXFontPath[sizeof(_NXFontPath) - 1] = '\0';
 
 #ifdef NX_TRANS_TEST
     fprintf(stderr, "_NXGetFontPath: Using default font path [%s].\n", _NXFontPath);
@@ -199,7 +199,7 @@ doOpenFont(ClientPtr client, OFclosurePtr c)
 	BitmapFormatScanlineUnit8;
 
 
-    nxagentOrigFontNameLen = (c -> origFontNameLen < 256) ? c -> origFontNameLen : 255;
+    nxagentOrigFontNameLen = (c -> origFontNameLen < sizeof(nxagentOrigFontName) ? c -> origFontNameLen : sizeof(nxagentOrigFontName) - 1);
 
     memcpy(nxagentOrigFontName, c -> origFontName, nxagentOrigFontNameLen);
 
-- 
cgit v1.2.3


From 4a345786c6ee3b00882f015a7ac7d1d3215c0b9f Mon Sep 17 00:00:00 2001
From: Ulrich Sibiller <uli42@gmx.de>
Date: Fri, 24 Nov 2017 00:25:25 +0100
Subject: Dialog.c,Display.c,NXdixfonts.c: replace strncpy() by snprintf where
 appropriate

---
 nx-X11/programs/Xserver/hw/nxagent/Args.h       |  2 +-
 nx-X11/programs/Xserver/hw/nxagent/Dialog.c     |  7 ++-----
 nx-X11/programs/Xserver/hw/nxagent/Display.c    | 12 +++++-------
 nx-X11/programs/Xserver/hw/nxagent/NXdixfonts.c |  5 ++---
 nx-X11/programs/Xserver/hw/nxagent/Reconnect.c  |  2 +-
 5 files changed, 11 insertions(+), 17 deletions(-)

diff --git a/nx-X11/programs/Xserver/hw/nxagent/Args.h b/nx-X11/programs/Xserver/hw/nxagent/Args.h
index d60488c0d..0bfc44a93 100644
--- a/nx-X11/programs/Xserver/hw/nxagent/Args.h
+++ b/nx-X11/programs/Xserver/hw/nxagent/Args.h
@@ -53,7 +53,7 @@ struct UserGeometry{
 extern Bool nxagentUseNXTrans;
 
 extern char nxagentSessionId[];
-extern char nxagentDisplayName[];
+extern char nxagentDisplayName[1024];
 extern char nxagentShadowDisplayName[];
 extern char nxagentWindowName[];
 extern char nxagentDialogName[];
diff --git a/nx-X11/programs/Xserver/hw/nxagent/Dialog.c b/nx-X11/programs/Xserver/hw/nxagent/Dialog.c
index df6bb1c89..1e394fe38 100644
--- a/nx-X11/programs/Xserver/hw/nxagent/Dialog.c
+++ b/nx-X11/programs/Xserver/hw/nxagent/Dialog.c
@@ -279,16 +279,13 @@ void nxagentLaunchDialog(DialogType dialogType)
 
   if (dialogType == DIALOG_FAILED_RECONNECTION)
   {
-    strncpy(dialogDisplay, nxagentDisplayName, sizeof(dialogDisplay) - 1);
+    snprintf(dialogDisplay, sizeof(dialogDisplay), "%s", nxagentDisplayName);
   }
   else
   {
-    strcpy(dialogDisplay, ":");
-    strncat(dialogDisplay, display, sizeof(dialogDisplay) - 1 - 1);
+    snprintf(dialogDisplay, sizeof(dialogDisplay), ":%s", display);
   }
 
-  dialogDisplay[sizeof(dialogDisplay) - 1] = '\0';
-
   /*
    * We don't want to receive SIGCHLD
    * before we store the child pid.
diff --git a/nx-X11/programs/Xserver/hw/nxagent/Display.c b/nx-X11/programs/Xserver/hw/nxagent/Display.c
index 5943e538e..f523dacde 100644
--- a/nx-X11/programs/Xserver/hw/nxagent/Display.c
+++ b/nx-X11/programs/Xserver/hw/nxagent/Display.c
@@ -1150,9 +1150,7 @@ void nxagentOpenDisplay(int argc, char *argv[])
 
   if (*nxagentDisplayName == '\0')
   {
-    strncpy(nxagentDisplayName, XDisplayName(NULL), sizeof(nxagentDisplayName) - 1);
-
-    nxagentDisplayName[sizeof(nxagentDisplayName) - 1] = '\0';
+    snprintf(nxagentDisplayName, sizeof(nxagentDisplayName), "%s", XDisplayName(NULL));
   }
 
   nxagentCloseDisplay();
@@ -1846,7 +1844,7 @@ static FILE *nxagentLookForIconFile(char *iconName, const char *permission,
     {
       strncpy(singlePath, path, (unsigned long)(end - path));
 
-      singlePath[(unsigned long)(end - path)] = 0;
+      singlePath[(unsigned long)(end - path)] = '\0';
 
       path = end + 1;
     }
@@ -1859,7 +1857,7 @@ static FILE *nxagentLookForIconFile(char *iconName, const char *permission,
 
     if (singlePath[strlen(singlePath)- 1] == slash[0])
     {
-      singlePath[strlen(singlePath)- 1] = 0;
+      singlePath[strlen(singlePath)- 1] = '\0';
     }
 
     if (strlen(singlePath) + strlen(iconName) + 1 < sizeof(singlePath)<)
@@ -1907,8 +1905,8 @@ Bool nxagentMakeIcon(Display *display, Pixmap *nxIcon, Pixmap *nxMask)
     agentIconData=nxagentIconData;
   }
 
-
-  snprintf(default_path, PATH_MAX-1, "/usr/NX/share/images/%s", agent_icon_name);
+  /* FIXME: use a compile time define here, /usr/NX is a nomachine path */
+  snprintf(default_path, sizeof(default_path), "/usr/NX/share/images/%s", agent_icon_name);
 
   if ((icon_fp = fopen(default_path, "r")) == NULL)
   {
diff --git a/nx-X11/programs/Xserver/hw/nxagent/NXdixfonts.c b/nx-X11/programs/Xserver/hw/nxagent/NXdixfonts.c
index db555d5fc..563dacd92 100644
--- a/nx-X11/programs/Xserver/hw/nxagent/NXdixfonts.c
+++ b/nx-X11/programs/Xserver/hw/nxagent/NXdixfonts.c
@@ -112,7 +112,7 @@ static const char *_NXGetFontPath(const char *path)
      * Check the environment only once.
      */
 
-    if (*_NXFontPath != '\0')
+    if (_NXFontPath[0] != '\0')
     {
         return _NXFontPath;
     }
@@ -140,8 +140,7 @@ static const char *_NXGetFontPath(const char *path)
 
 _NXGetFontPathError:
 
-    strncpy(_NXFontPath, path, sizeof(_NXFontPath) - 1);
-    _NXFontPath[sizeof(_NXFontPath) - 1] = '\0';
+    snprintf(_NXFontPath, sizeof(_NXFontPath), "%s", path);
 
 #ifdef NX_TRANS_TEST
     fprintf(stderr, "_NXGetFontPath: Using default font path [%s].\n", _NXFontPath);
diff --git a/nx-X11/programs/Xserver/hw/nxagent/Reconnect.c b/nx-X11/programs/Xserver/hw/nxagent/Reconnect.c
index cafa219ec..4774579aa 100644
--- a/nx-X11/programs/Xserver/hw/nxagent/Reconnect.c
+++ b/nx-X11/programs/Xserver/hw/nxagent/Reconnect.c
@@ -139,7 +139,7 @@ char stateFile[PATH_MAX];
 
 void setStatePath(char* path)
 {
-    strncpy(stateFile, path, PATH_MAX-1);
+    snprintf(stateFile, PATH_MAX, "%s", path);
 }
 
 void saveAgentState(char* state)
-- 
cgit v1.2.3


From 3de6bc7490ff6907cd0203c6143a75588458dbb9 Mon Sep 17 00:00:00 2001
From: Ulrich Sibiller <uli42@gmx.de>
Date: Thu, 23 Nov 2017 23:18:44 +0100
Subject: Dialog.c: fix possible buffer overflows

Fix write past the end of singlePath if PATH contains dirs longer than PATH_MAX.
---
 nx-X11/programs/Xserver/hw/nxagent/Display.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/nx-X11/programs/Xserver/hw/nxagent/Display.c b/nx-X11/programs/Xserver/hw/nxagent/Display.c
index f523dacde..d4e032046 100644
--- a/nx-X11/programs/Xserver/hw/nxagent/Display.c
+++ b/nx-X11/programs/Xserver/hw/nxagent/Display.c
@@ -1842,6 +1842,13 @@ static FILE *nxagentLookForIconFile(char *iconName, const char *permission,
 
     if (end != NULL)
     {
+      if ((end - path) > sizeof(singlePath) - 1)
+      {
+        fprintf(stderr, "Warning: Path too long - ignored.\n");
+        path = end + 1;
+        continue;
+      }
+
       strncpy(singlePath, path, (unsigned long)(end - path));
 
       singlePath[(unsigned long)(end - path)] = '\0';
@@ -1850,6 +1857,12 @@ static FILE *nxagentLookForIconFile(char *iconName, const char *permission,
     }
     else
     {
+      if (strlen(path) > sizeof(singlePath) - 1)
+      {
+        fprintf(stderr, "Error: Path too long.\n");
+        return NULL;
+      }
+
       strcpy(singlePath, path);
 
       breakLoop = 1;
-- 
cgit v1.2.3


From 0e2c4df8e504e18c4ee73cb91ffaefdf58baecec Mon Sep 17 00:00:00 2001
From: Ulrich Sibiller <uli42@gmx.de>
Date: Fri, 24 Nov 2017 00:48:42 +0100
Subject: Keyboard.c: fix memory leak

---
 nx-X11/programs/Xserver/hw/nxagent/Keyboard.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/nx-X11/programs/Xserver/hw/nxagent/Keyboard.c b/nx-X11/programs/Xserver/hw/nxagent/Keyboard.c
index 8ae64ee00..e77e44465 100644
--- a/nx-X11/programs/Xserver/hw/nxagent/Keyboard.c
+++ b/nx-X11/programs/Xserver/hw/nxagent/Keyboard.c
@@ -1904,10 +1904,12 @@ void nxagentKeycodeConversionSetup(void)
       FILE *keyboard_file;
       if (!keyboard_file_path)
       {
-        FatalError("nxagentKeycodeConversionSetup: malloc failed.");
+        free(sessionpath);
+        FatalError("malloc for keyboard file path failed.");
       }
       strcpy(keyboard_file_path, sessionpath);
       strcat(keyboard_file_path, "/keyboard");
+      free(sessionpath);
       if ((keyboard_file = fopen(keyboard_file_path, "w"))) {
         if (drules)
           fprintf(keyboard_file, "rules=\"%s\"\n", drules[0] == '\0' ? "," : drules);
-- 
cgit v1.2.3


From 08912ef304f019cd473243d389a9dee237b01bea Mon Sep 17 00:00:00 2001
From: Ulrich Sibiller <uli42@gmx.de>
Date: Fri, 24 Nov 2017 00:49:17 +0100
Subject: Keyboard.c: improve user messages for keyboard file handling

---
 nx-X11/programs/Xserver/hw/nxagent/Keyboard.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nx-X11/programs/Xserver/hw/nxagent/Keyboard.c b/nx-X11/programs/Xserver/hw/nxagent/Keyboard.c
index e77e44465..9f1764cd0 100644
--- a/nx-X11/programs/Xserver/hw/nxagent/Keyboard.c
+++ b/nx-X11/programs/Xserver/hw/nxagent/Keyboard.c
@@ -1922,7 +1922,7 @@ void nxagentKeycodeConversionSetup(void)
         if (doptions)
           fprintf(keyboard_file, "options=\"%s\"\n", doptions[0] == '\0' ? "," : doptions);
         fclose(keyboard_file);
-        fprintf(stderr, "Info: keyboard file created\n");
+        fprintf(stderr, "Info: keyboard file created: '%s'\n", keyboard_file_path);
       }
       else
       {
-- 
cgit v1.2.3


From 2836c72f786e550252d75cf5f274245e8de5b5f9 Mon Sep 17 00:00:00 2001
From: Ulrich Sibiller <uli42@gmx.de>
Date: Fri, 24 Nov 2017 00:54:14 +0100
Subject: Keyboard.c: replace malloc + strcpy by asprintf

---
 nx-X11/programs/Xserver/hw/nxagent/Keyboard.c | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/nx-X11/programs/Xserver/hw/nxagent/Keyboard.c b/nx-X11/programs/Xserver/hw/nxagent/Keyboard.c
index 9f1764cd0..cddb3457e 100644
--- a/nx-X11/programs/Xserver/hw/nxagent/Keyboard.c
+++ b/nx-X11/programs/Xserver/hw/nxagent/Keyboard.c
@@ -1899,18 +1899,16 @@ void nxagentKeycodeConversionSetup(void)
     char *sessionpath = nxagentGetSessionPath();
     if (sessionpath)
     {
-      int keyboard_file_path_size = strlen(sessionpath) + strlen("/keyboard");
-      char *keyboard_file_path = malloc((keyboard_file_path_size + 1) * sizeof(char));
+      char *keyboard_file_path = NULL;
       FILE *keyboard_file;
-      if (!keyboard_file_path)
+      if ((asprintf(&keyboard_file_path, "%s/keyboard", sessionpath) == -1))
       {
         free(sessionpath);
         FatalError("malloc for keyboard file path failed.");
       }
-      strcpy(keyboard_file_path, sessionpath);
-      strcat(keyboard_file_path, "/keyboard");
       free(sessionpath);
-      if ((keyboard_file = fopen(keyboard_file_path, "w"))) {
+      if ((keyboard_file = fopen(keyboard_file_path, "w")))
+      {
         if (drules)
           fprintf(keyboard_file, "rules=\"%s\"\n", drules[0] == '\0' ? "," : drules);
         if (dmodel)
-- 
cgit v1.2.3


From 9d5c83e2fd215e9e6a6345bc11ee195789e028cb Mon Sep 17 00:00:00 2001
From: Ulrich Sibiller <uli42@gmx.de>
Date: Fri, 8 Dec 2017 00:17:24 +0100
Subject: Font.c: shorten string handling

---
 nx-X11/programs/Xserver/hw/nxagent/Font.c | 25 +++++++------------------
 1 file changed, 7 insertions(+), 18 deletions(-)

diff --git a/nx-X11/programs/Xserver/hw/nxagent/Font.c b/nx-X11/programs/Xserver/hw/nxagent/Font.c
index c7fcaf346..0a9f6e3c3 100644
--- a/nx-X11/programs/Xserver/hw/nxagent/Font.c
+++ b/nx-X11/programs/Xserver/hw/nxagent/Font.c
@@ -1452,9 +1452,11 @@ void nxagentVerifyDefaultFontPath(void)
   fprintf(stderr, "nxagentVerifyDefaultFontPath: Going to search for one or more valid font paths.\n");
   #endif
 
-  fontPath = malloc(strlen(defaultFontPath) + 1);
+  /*
+   * Set the default font path as the first choice.
+   */
 
-  if (fontPath == NULL)
+  if ((fontPath = strdup(defaultFontPath)) == NULL)
   {
     #ifdef WARNING
     fprintf(stderr, "nxagentVerifyDefaultFontPath: WARNING! Unable to allocate memory for a new font path. "
@@ -1464,12 +1466,6 @@ void nxagentVerifyDefaultFontPath(void)
     return;
   }
 
-  /*
-   * Set the default font path as the first choice.
-   */
-
-  strcpy(fontPath, defaultFontPath);
-
   if (stat(NXAGENT_DEFAULT_FONT_DIR, &dirStat) == 0 &&
           S_ISDIR(dirStat.st_mode) != 0)
   {
@@ -1741,9 +1737,7 @@ int nxagentSplitString(char *string, char *fields[], int nfields, char *sep)
 
     if (i < nfields)
     {
-      fields[i] = (char *) malloc(fieldlen + 1);
-      strncpy(fields[i], current, fieldlen);
-      *(fields[i] + fieldlen) = 0;
+      fields[i] = strndup(current, fieldlen);
     }
     else
     {
@@ -1767,14 +1761,9 @@ char *nxagentMakeScalableFontName(const char *fontName, int scalableResolution)
 {
   char *scalableFontName;
   const char *s;
-  int len;
   int field;
 
-  len = strlen(fontName) + 1;
-
-  scalableFontName = malloc(len);
-
-  if (scalableFontName == NULL)
+  if ((scalableFontName = malloc(strlen(fontName) + 1)) == NULL)
   {
     #ifdef PANIC
     fprintf(stderr, "nxagentMakeScalableFontName: PANIC! malloc() failed.\n");
@@ -1783,7 +1772,7 @@ char *nxagentMakeScalableFontName(const char *fontName, int scalableResolution)
     return NULL;
   }
 
-  scalableFontName[0] = 0;
+  scalableFontName[0] = '\0';
 
   if (*fontName != '-')
   {
-- 
cgit v1.2.3


From 677da7fd30f3bd8d2fc074f5d5d4916f53bac736 Mon Sep 17 00:00:00 2001
From: Ulrich Sibiller <uli42@gmx.de>
Date: Fri, 8 Dec 2017 00:19:50 +0100
Subject: Screen.c: string handling improvements

---
 nx-X11/programs/Xserver/hw/nxagent/Screen.c | 26 ++++++++++----------------
 1 file changed, 10 insertions(+), 16 deletions(-)

diff --git a/nx-X11/programs/Xserver/hw/nxagent/Screen.c b/nx-X11/programs/Xserver/hw/nxagent/Screen.c
index dd0fa301d..69c50cdf3 100644
--- a/nx-X11/programs/Xserver/hw/nxagent/Screen.c
+++ b/nx-X11/programs/Xserver/hw/nxagent/Screen.c
@@ -1783,36 +1783,31 @@ N/A
       if(nxagentX2go)
       {
         #ifdef TEST
-        fprintf(stderr, "nxagentOpenScreen: Setting WM_CLASS and WM_NAME for window withid [%ld].\n",
+        fprintf(stderr, "nxagentOpenScreen: Setting WM_CLASS and WM_NAME for window with id [%ld].\n",
                 (long int)nxagentDefaultWindows[pScreen->myNum]);
         #endif
         XClassHint hint;
-        hint.res_name=malloc(strlen("X2GoAgent")+1);
-        hint.res_class=malloc(strlen("X2GoAgent")+1);
-        strcpy(hint.res_name,"X2GoAgent");
-        strcpy(hint.res_class,"X2GoAgent");
-        XSetClassHint(nxagentDisplay,nxagentDefaultWindows[pScreen->myNum],&hint);
+        hint.res_name = strdup("X2GoAgent");
+        hint.res_class = strdup("X2GoAgent");
+        XSetClassHint(nxagentDisplay, nxagentDefaultWindows[pScreen->myNum], &hint);
         free(hint.res_name);
         free(hint.res_class);
       }
       else
       {
         #ifdef TEST
-        fprintf(stderr, "nxagentOpenScreen: Setting WM_CLASS and WM_NAME for window withid [%ld].\n",
+        fprintf(stderr, "nxagentOpenScreen: Setting WM_CLASS and WM_NAME for window with id [%ld].\n",
                 (long int)nxagentDefaultWindows[pScreen->myNum]);
         #endif
 
         XClassHint hint;
-        hint.res_name=malloc(strlen("NXAgent")+1);
-        hint.res_class=malloc(strlen("NXAgent")+1);
-        strcpy(hint.res_name,"NXAgent");
-        strcpy(hint.res_class,"NXAgent");
-        XSetClassHint(nxagentDisplay,nxagentDefaultWindows[pScreen->myNum],&hint);
+        hint.res_name = strdup("NXAgent");
+        hint.res_class = strdup("NXAgent");
+        XSetClassHint(nxagentDisplay, nxagentDefaultWindows[pScreen->myNum], &hint);
         free(hint.res_name);
         free(hint.res_class);
       }
 
-
       if (nxagentOption(Fullscreen))
       {
         nxagentFullscreenWindow = nxagentDefaultWindows[pScreen->myNum];
@@ -2549,9 +2544,7 @@ int nxagentShadowInit(ScreenPtr pScreen, WindowPtr pWin)
     }
     else
     {
-      layout = malloc(strlen(&nxagentKeyboard[i + 1]) + 1);
-
-      strcpy(layout, &nxagentKeyboard[i + 1]);
+      layout = strdup(&nxagentKeyboard[i + 1]);
     }
   }
 
@@ -3480,6 +3473,7 @@ FIXME: The port information is not used at the moment and produces a
                in++;
                local_buf[in]=pszReturnData[i-1];
 
+               /* "localhost:" */
                strcat(local_buf,"6c6f63616c686f73743a");
                in+=20;
 
-- 
cgit v1.2.3


From 9a6b90c316e6ad2a5180ee9be4b0c9c7139d86b7 Mon Sep 17 00:00:00 2001
From: Ulrich Sibiller <uli42@gmx.de>
Date: Fri, 8 Dec 2017 00:30:32 +0100
Subject: Font.c: make nxagentGetFontServerPath more readable

---
 nx-X11/programs/Xserver/hw/nxagent/Font.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/nx-X11/programs/Xserver/hw/nxagent/Font.c b/nx-X11/programs/Xserver/hw/nxagent/Font.c
index 0a9f6e3c3..39c3b31e1 100644
--- a/nx-X11/programs/Xserver/hw/nxagent/Font.c
+++ b/nx-X11/programs/Xserver/hw/nxagent/Font.c
@@ -1411,11 +1411,12 @@ static Bool nxagentGetFontServerPath(char * fontServerPath)
 
   if (NXGetFontParameters(nxagentDisplay, sizeof(path), path) == True)
   {
-    if (*path != '\0')
-    {
-      strncpy(fontServerPath, path + 1, *path);
+    unsigned int len = *path;
 
-      fontServerPath[*path] = '\0';
+    if (len)
+    {
+      strncpy(fontServerPath, path + 1, len);
+      fontServerPath[len] = '\0';
 
       #ifdef TEST
       fprintf(stderr, "nxagentGetFontServerPath: Got path [%s].\n",
-- 
cgit v1.2.3


From ea1e0bea3c41f5c8ad8fc3e22ecd8f2d44e82685 Mon Sep 17 00:00:00 2001
From: Ulrich Sibiller <uli42@gmx.de>
Date: Tue, 2 Jan 2018 19:23:20 +0100
Subject: Replace hardcoded string lengths by macros

---
 nx-X11/programs/Xserver/hw/nxagent/Args.c       | 71 +++++++------------------
 nx-X11/programs/Xserver/hw/nxagent/Args.h       | 16 ++++--
 nx-X11/programs/Xserver/hw/nxagent/Dialog.c     |  8 +--
 nx-X11/programs/Xserver/hw/nxagent/Dialog.h     |  6 ++-
 nx-X11/programs/Xserver/hw/nxagent/Display.c    |  2 +-
 nx-X11/programs/Xserver/hw/nxagent/NXdixfonts.c |  9 ++--
 6 files changed, 43 insertions(+), 69 deletions(-)

diff --git a/nx-X11/programs/Xserver/hw/nxagent/Args.c b/nx-X11/programs/Xserver/hw/nxagent/Args.c
index cccfd40e0..8ee64ba75 100644
--- a/nx-X11/programs/Xserver/hw/nxagent/Args.c
+++ b/nx-X11/programs/Xserver/hw/nxagent/Args.c
@@ -126,15 +126,15 @@ extern char dispatchExceptionAtReset;
 
 extern const char *__progname;
 
-char nxagentDisplayName[1024];
+char nxagentDisplayName[NXAGENTDISPLAYNAMELENGTH];
 Bool nxagentSynchronize = False;
 Bool nxagentRealWindowProp = False;
 
-char nxagentShadowDisplayName[1024] = {0};
+char nxagentShadowDisplayName[NXAGENTSHADOWDISPLAYNAMELENGTH] = {0};
 
-char nxagentWindowName[256];
-char nxagentDialogName[256];
-char nxagentSessionId[256] = {0};
+char nxagentWindowName[NXAGENTWINDOWNAMELENGTH];
+char nxagentDialogName[NXAGENTDIALOGNAMELENGTH];
+char nxagentSessionId[NXAGENTSESSIONIDLENGTH] = {0};
 char *nxagentOptionsFilenameOrString;
 
 Bool nxagentFullGeneration = False;
@@ -326,10 +326,7 @@ int ddxProcessArgument(int argc, char *argv[], int i)
   {
     if (++i < argc)
     {
-      strncpy(nxagentDisplayName, argv[i], 1023);
-
-      nxagentDisplayName[1023] = '\0';
-
+      snprintf(nxagentDisplayName, NXAGENTDISPLAYNAMELENGTH, "%s", argv[i]);
       return 2;
     }
 
@@ -340,10 +337,7 @@ int ddxProcessArgument(int argc, char *argv[], int i)
   {
     if (++i < argc)
     {
-      strncpy(nxagentSessionId, argv[i], 255);
-
-      *(nxagentSessionId + 255) = '\0';
-
+      snprintf(nxagentSessionId, NXAGENTSESSIONIDLENGTH, "%s", argv[i]);
       return 2;
     }
 
@@ -360,35 +354,13 @@ int ddxProcessArgument(int argc, char *argv[], int i)
   {
     if (++i < argc)
     {
-      int size;
-
       free(nxagentOptionsFilenameOrString);
       nxagentOptionsFilenameOrString = NULL;
 
-      if ((size = strlen(argv[i])) < 1024)
+      if (-1 == asprintf(&nxagentOptionsFilenameOrString, "%s", argv[i]))
       {
-        if ((nxagentOptionsFilenameOrString = malloc(size + 1)) == NULL)
-        {
-          FatalError("malloc failed");
-        }
-
-        strncpy(nxagentOptionsFilenameOrString, argv[i], size);
-
-        nxagentOptionsFilenameOrString[size] = '\0';
+        FatalError("malloc failed");
       }
-      else
-      {
-        /*
-         * It is useless to store the file name
-         * that has just been truncated.
-         */
-
-        #ifdef WARNING
-        fprintf(stderr, "ddxProcessArgument: WARNING! Option file name "
-                    "too long. It will be ignored.\n");
-        #endif
-      }
-
       return 2;
     }
 
@@ -670,10 +642,7 @@ int ddxProcessArgument(int argc, char *argv[], int i)
   {
     if (++i < argc)
     {
-      strncpy(nxagentWindowName, argv[i], 255);
-
-      *(nxagentWindowName + 255) = '\0';
-
+      snprintf(nxagentWindowName, NXAGENTWINDOWNAMELENGTH, "%s", argv[i]);
       return 2;
     }
 
@@ -903,15 +872,13 @@ int ddxProcessArgument(int argc, char *argv[], int i)
   {
     if (++i < argc)
     {
-      strncpy(nxagentShadowDisplayName, argv[i], 1023);
+      snprintf(nxagentShadowDisplayName, NXAGENTSHADOWDISPLAYNAMELENGTH, "%s", argv[i]);
 
       if (strcmp(nxagentShadowDisplayName, "") == 0)
       {
         FatalError("Invalid shadow display option");
       }
 
-      *(nxagentShadowDisplayName + 1023) = '\0';
-
       return 2;
     }
 
@@ -1780,9 +1747,7 @@ N/A
 
     if (*nxagentWindowName == '\0')
     {
-      strncpy(nxagentWindowName, "NX", 255);
-
-      *(nxagentWindowName + 255) = '\0';
+      snprintf(nxagentWindowName, NXAGENTWINDOWNAMELENGTH, "NX");
     }
 
     /*
@@ -2161,9 +2126,7 @@ void ddxUseMsg()
 
 static int nxagentGetDialogName()
 {
-  strcpy(nxagentDialogName, "NX");
-
-  *(nxagentDialogName + 255) = '\0';
+  snprintf(nxagentDialogName, NXAGENTDIALOGNAMELENGTH, "NX");
 
   if (*nxagentSessionId != '\0')
   {
@@ -2171,17 +2134,19 @@ static int nxagentGetDialogName()
 
     strcpy(nxagentDialogName, "NX - ");
 
+    /* if the session id contains an MD5 hash in a well-known format cut it off */
     if (length > (MD5_LENGTH * 2 + 1) &&
            *(nxagentSessionId + (length - (MD5_LENGTH * 2 + 1))) == '-')
     {
-      strncat(nxagentDialogName, nxagentSessionId, length - (MD5_LENGTH * 2 + 1));
+      strncat(nxagentDialogName, nxagentSessionId,
+              MIN(NXAGENTDIALOGNAMELENGTH - strlen(nxagentDialogName), length - (MD5_LENGTH * 2 + 1)) - 1);
     }
     else
     {
-      strncat(nxagentDialogName, nxagentSessionId, 250);
+      strncat(nxagentDialogName, nxagentSessionId, NXAGENTDIALOGNAMELENGTH - strlen(nxagentDialogName) - 1);
     }
 
-    *(nxagentSessionId + 255) = '\0';
+    nxagentDialogName[NXAGENTDIALOGNAMELENGTH - 1] = '\0';
 
     return 1;
   }
diff --git a/nx-X11/programs/Xserver/hw/nxagent/Args.h b/nx-X11/programs/Xserver/hw/nxagent/Args.h
index 0bfc44a93..a3f7e349b 100644
--- a/nx-X11/programs/Xserver/hw/nxagent/Args.h
+++ b/nx-X11/programs/Xserver/hw/nxagent/Args.h
@@ -52,11 +52,17 @@ struct UserGeometry{
 
 extern Bool nxagentUseNXTrans;
 
-extern char nxagentSessionId[];
-extern char nxagentDisplayName[1024];
-extern char nxagentShadowDisplayName[];
-extern char nxagentWindowName[];
-extern char nxagentDialogName[];
+#define NXAGENTSESSIONIDLENGTH 256
+#define NXAGENTDISPLAYNAMELENGTH 1024
+#define NXAGENTSHADOWDISPLAYNAMELENGTH 1024
+#define NXAGENTWINDOWNAMELENGTH 256
+#define NXAGENTDIALOGNAMELENGTH 256
+
+extern char nxagentSessionId[NXAGENTSESSIONIDLENGTH];
+extern char nxagentDisplayName[NXAGENTDISPLAYNAMELENGTH];
+extern char nxagentShadowDisplayName[NXAGENTSHADOWDISPLAYNAMELENGTH];
+extern char nxagentWindowName[NXAGENTWINDOWNAMELENGTH];
+extern char nxagentDialogName[NXAGENTDIALOGNAMELENGTH];
 
 extern Bool nxagentSynchronize;
 extern Bool nxagentRealWindowProp;
diff --git a/nx-X11/programs/Xserver/hw/nxagent/Dialog.c b/nx-X11/programs/Xserver/hw/nxagent/Dialog.c
index 1e394fe38..c09618693 100644
--- a/nx-X11/programs/Xserver/hw/nxagent/Dialog.c
+++ b/nx-X11/programs/Xserver/hw/nxagent/Dialog.c
@@ -66,9 +66,9 @@ int nxagentDisableDeferModePid = 0;
 
 static int nxagentFailedReconnectionDialogPid = 0;
 
-char nxagentPulldownWindow[16];
+char nxagentPulldownWindow[NXAGENTPULLDOWNWINDOWLENGTH];
 
-char nxagentFailedReconnectionMessage[256];
+char nxagentFailedReconnectionMessage[NXAGENTFAILEDRECONNECTIONMESSAGELENGTH];
 
 void nxagentResetDialog(int pid)
 {
@@ -317,7 +317,7 @@ void nxagentLaunchDialog(DialogType dialogType)
 
 void nxagentPulldownDialog(Window wid)
 {
-  snprintf(nxagentPulldownWindow, sizeof(nxagentPulldownWindow), "%ld", (long int) wid);
+  snprintf(nxagentPulldownWindow, NXAGENTPULLDOWNWINDOWLENGTH, "%ld", (long int) wid);
 
   #ifdef TEST
   fprintf(stderr, "nxagentPulldownDialog: Going to launch pulldown "
@@ -368,7 +368,7 @@ void nxagentFailedReconnectionDialog(int alert, char *error)
     int status;
     int options = 0;
 
-    snprintf(nxagentFailedReconnectionMessage, sizeof(nxagentFailedReconnectionMessage), "Reconnection failed: %s", error);
+    snprintf(nxagentFailedReconnectionMessage, NXAGENTFAILEDRECONNECTIONMESSAGELENGTH, "Reconnection failed: %s", error);
 
     nxagentLaunchDialog(DIALOG_FAILED_RECONNECTION);
 
diff --git a/nx-X11/programs/Xserver/hw/nxagent/Dialog.h b/nx-X11/programs/Xserver/hw/nxagent/Dialog.h
index 133dee242..ffcdf48f2 100644
--- a/nx-X11/programs/Xserver/hw/nxagent/Dialog.h
+++ b/nx-X11/programs/Xserver/hw/nxagent/Dialog.h
@@ -55,9 +55,11 @@ extern int nxagentDisableRandRModeDialogPid;
 extern int nxagentEnableDeferModePid;
 extern int nxagentDisableDeferModePid;
 
-extern char nxagentFailedReconnectionMessage[];
+#define NXAGENTFAILEDRECONNECTIONMESSAGELENGTH 256
+extern char nxagentFailedReconnectionMessage[NXAGENTFAILEDRECONNECTIONMESSAGELENGTH];
 
-extern char nxagentPulldownWindow[];
+#define NXAGENTPULLDOWNWINDOWLENGTH 16
+extern char nxagentPulldownWindow[NXAGENTPULLDOWNWINDOWLENGTH];
 
 extern void nxagentLaunchDialog(DialogType type);
 extern void nxagentResetDialog(int pid);
diff --git a/nx-X11/programs/Xserver/hw/nxagent/Display.c b/nx-X11/programs/Xserver/hw/nxagent/Display.c
index d4e032046..c9c2f4e7a 100644
--- a/nx-X11/programs/Xserver/hw/nxagent/Display.c
+++ b/nx-X11/programs/Xserver/hw/nxagent/Display.c
@@ -1150,7 +1150,7 @@ void nxagentOpenDisplay(int argc, char *argv[])
 
   if (*nxagentDisplayName == '\0')
   {
-    snprintf(nxagentDisplayName, sizeof(nxagentDisplayName), "%s", XDisplayName(NULL));
+    snprintf(nxagentDisplayName, NXAGENTDISPLAYNAMELENGTH, "%s", XDisplayName(NULL));
   }
 
   nxagentCloseDisplay();
diff --git a/nx-X11/programs/Xserver/hw/nxagent/NXdixfonts.c b/nx-X11/programs/Xserver/hw/nxagent/NXdixfonts.c
index 563dacd92..e59144f94 100644
--- a/nx-X11/programs/Xserver/hw/nxagent/NXdixfonts.c
+++ b/nx-X11/programs/Xserver/hw/nxagent/NXdixfonts.c
@@ -96,7 +96,8 @@ static Bool doListFontsAndAliases(ClientPtr client, LFclosurePtr c);
 
 #ifdef NX_TRANS_SOCKET
 
-char _NXFontPath[1024];
+#define NXFONTPATHLENGTH 1024
+char _NXFontPath[NXFONTPATHLENGTH];
 
 /*
  * Override the default font path and make
@@ -121,7 +122,7 @@ static const char *_NXGetFontPath(const char *path)
 
     if (fontEnv != NULL && *fontEnv != '\0')
     {
-        if (strlen(fontEnv) + 1 > sizeof(_NXFontPath))
+        if (strlen(fontEnv) + 1 > NXFONTPATHLENGTH)
         {
 #ifdef NX_TRANS_TEST
             fprintf(stderr, "_NXGetFontPath: WARNING! Maximum length of font path exceeded.\n");
@@ -129,7 +130,7 @@ static const char *_NXGetFontPath(const char *path)
             goto _NXGetFontPathError;
         }
 
-        strcpy(_NXFontPath, fontEnv);
+        snprintf(_NXFontPath, NXFONTPATHLENGTH, "%s", fontEnv);
 
 #ifdef NX_TRANS_TEST
         fprintf(stderr, "_NXGetFontPath: Using NX font path [%s].\n", _NXFontPath);
@@ -140,7 +141,7 @@ static const char *_NXGetFontPath(const char *path)
 
 _NXGetFontPathError:
 
-    snprintf(_NXFontPath, sizeof(_NXFontPath), "%s", path);
+    snprintf(_NXFontPath, NXFONTPATHLENGTH, "%s", path);
 
 #ifdef NX_TRANS_TEST
     fprintf(stderr, "_NXGetFontPath: Using default font path [%s].\n", _NXFontPath);
-- 
cgit v1.2.3


From 19a3918a7216ac1006bdfd96239fafc6eb97d523 Mon Sep 17 00:00:00 2001
From: Ulrich Sibiller <uli42@gmx.de>
Date: Tue, 2 Jan 2018 19:24:49 +0100
Subject: Display.c: pass down buffer size to nxagentLookForIconFile

Also comment the code and convert error messages to warnings.
---
 nx-X11/programs/Xserver/hw/nxagent/Display.c | 46 +++++++++++++---------------
 1 file changed, 22 insertions(+), 24 deletions(-)

diff --git a/nx-X11/programs/Xserver/hw/nxagent/Display.c b/nx-X11/programs/Xserver/hw/nxagent/Display.c
index c9c2f4e7a..b78530e37 100644
--- a/nx-X11/programs/Xserver/hw/nxagent/Display.c
+++ b/nx-X11/programs/Xserver/hw/nxagent/Display.c
@@ -1815,12 +1815,10 @@ FIXME: Is this needed?
 }
 
 static FILE *nxagentLookForIconFile(char *iconName, const char *permission,
-                                        char *return_path)
+                                        char *return_path, int return_path_size)
 {
   char *path;
-  char *end;
   char singlePath[PATH_MAX];
-  int breakLoop;
   FILE *fptr = NULL;
 
   #ifdef WIN32
@@ -1836,56 +1834,56 @@ static FILE *nxagentLookForIconFile(char *iconName, const char *permission,
     return NULL;
   }
 
-  for(breakLoop = 0; breakLoop == 0 && fptr == NULL; )
+  for (int breakLoop = False; breakLoop == False && fptr == NULL; )
   {
-    end = strchr(path, separator);
+    char *end = strchr(path, separator);
 
+    /* separator found */
     if (end != NULL)
     {
       if ((end - path) > sizeof(singlePath) - 1)
       {
-        fprintf(stderr, "Warning: Path too long - ignored.\n");
+        fprintf(stderr, "Warning: PATH component too long - ignoring it.\n");
         path = end + 1;
         continue;
       }
 
-      strncpy(singlePath, path, (unsigned long)(end - path));
-
-      singlePath[(unsigned long)(end - path)] = '\0';
-
+      snprintf(singlePath, (unsigned long)(end - path + 1), "%s", path);
       path = end + 1;
     }
     else
     {
       if (strlen(path) > sizeof(singlePath) - 1)
       {
-        fprintf(stderr, "Error: Path too long.\n");
+        fprintf(stderr, "Warning: PATH component too long - ignoring it.\n");
         return NULL;
       }
 
-      strcpy(singlePath, path);
+      snprintf(singlePath, sizeof(singlePath), "%s", path);
 
-      breakLoop = 1;
+      breakLoop = True;
     }
 
-    if (singlePath[strlen(singlePath)- 1] == slash[0])
+    /* cut off trailing slashes, if any */
+    while (singlePath[strlen(singlePath) - 1] == slash[0])
     {
-      singlePath[strlen(singlePath)- 1] = '\0';
+      singlePath[strlen(singlePath) - 1] = '\0';
     }
 
-    if (strlen(singlePath) + strlen(iconName) + 1 < sizeof(singlePath)<)
+    /* append slash and icon name */
+    if (strlen(singlePath) + strlen(iconName) + 1 < sizeof(singlePath))
     {
       strncat(singlePath, slash, 1);
       strcat(singlePath, iconName);
 
       if ((fptr = fopen(singlePath, permission)) != NULL)
       {
-        strcpy(return_path, singlePath);
+        snprintf(return_path, return_path_size, "%s", singlePath);
       }
     }
     else
     {
-      fprintf(stderr, "Error: Path too long.\n");
+      fprintf(stderr, "Warning: Icon path too long.\n");
     }
   }
 
@@ -1909,13 +1907,13 @@ Bool nxagentMakeIcon(Display *display, Pixmap *nxIcon, Pixmap *nxMask)
    */
   if(nxagentX2go)
   {
-    agent_icon_name=X2GOAGENT_ICON_NAME;
-    agentIconData=x2goagentIconData;
+    agent_icon_name = X2GOAGENT_ICON_NAME;
+    agentIconData = x2goagentIconData;
   }
   else
   {
-    agent_icon_name=NXAGENT_ICON_NAME;
-    agentIconData=nxagentIconData;
+    agent_icon_name = NXAGENT_ICON_NAME;
+    agentIconData = nxagentIconData;
   }
 
   /* FIXME: use a compile time define here, /usr/NX is a nomachine path */
@@ -1923,7 +1921,7 @@ Bool nxagentMakeIcon(Display *display, Pixmap *nxIcon, Pixmap *nxMask)
 
   if ((icon_fp = fopen(default_path, "r")) == NULL)
   {
-    icon_fp = nxagentLookForIconFile(agent_icon_name, "r", icon_path);
+    icon_fp = nxagentLookForIconFile(agent_icon_name, "r", icon_path, sizeof(icon_path));
 
     if (icon_fp != NULL)
     {
@@ -1935,7 +1933,7 @@ Bool nxagentMakeIcon(Display *display, Pixmap *nxIcon, Pixmap *nxMask)
   {
     fclose (icon_fp);
     success = True;
-    strcpy(icon_path, default_path);
+    snprintf(icon_path, sizeof(icon_path), "%s", default_path);
   }
 
   if (success)
-- 
cgit v1.2.3


From a8a693817ddb84143ffea22668c32f755336ce09 Mon Sep 17 00:00:00 2001
From: Ulrich Sibiller <uli42@gmx.de>
Date: Tue, 2 Jan 2018 21:02:41 +0100
Subject: Font.c: pass down size

---
 nx-X11/programs/Xserver/hw/nxagent/Font.c | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/nx-X11/programs/Xserver/hw/nxagent/Font.c b/nx-X11/programs/Xserver/hw/nxagent/Font.c
index 39c3b31e1..5a9b729ed 100644
--- a/nx-X11/programs/Xserver/hw/nxagent/Font.c
+++ b/nx-X11/programs/Xserver/hw/nxagent/Font.c
@@ -109,7 +109,7 @@ static void nxagentFontReconnect(FontPtr, XID, void *);
 static XFontStruct *nxagentLoadBestQueryFont(Display* dpy, char *fontName, FontPtr pFont);
 static XFontStruct *nxagentLoadQueryFont(register Display *dpy , char *fontName , FontPtr pFont);
 int nxagentFreeFont(XFontStruct *fs);
-static Bool nxagentGetFontServerPath(char * fontServerPath);
+static Bool nxagentGetFontServerPath(char * fontServerPath, int size);
 
 static char * nxagentMakeScalableFontName(const char *fontName, int scalableResolution);
 
@@ -1283,7 +1283,7 @@ Bool nxagentReconnectFailedFonts(void *p0)
   fprintf(stderr, "nxagentReconnectFailedFonts: \n");
   #endif
 
-  if (nxagentGetFontServerPath(fontServerPath) == False)
+  if (nxagentGetFontServerPath(fontServerPath, sizeof(fontServerPath)) == False)
   {
     #ifdef WARNING
     fprintf(stderr, "nxagentReconnectFailedFonts: WARNING! "
@@ -1404,19 +1404,18 @@ Bool nxagentDisconnectAllFonts()
   return True;
 }
 
-static Bool nxagentGetFontServerPath(char * fontServerPath)
+static Bool nxagentGetFontServerPath(char * fontServerPath, int size)
 {
-  /* ensure path is no longer than fontServerPath */
   char path[256] = {0};
 
   if (NXGetFontParameters(nxagentDisplay, sizeof(path), path) == True)
   {
+    /* the length is stored in the first byte and is therefore limited to 255 */
     unsigned int len = *path;
 
     if (len)
     {
-      strncpy(fontServerPath, path + 1, len);
-      fontServerPath[len] = '\0';
+      snprintf(fontServerPath, MIN(size, len + 1), "%s", path + 1);
 
       #ifdef TEST
       fprintf(stderr, "nxagentGetFontServerPath: Got path [%s].\n",
-- 
cgit v1.2.3


From 6c080c8397dd04e9b83836a40fb1094775265b83 Mon Sep 17 00:00:00 2001
From: Ulrich Sibiller <uli42@gmx.de>
Date: Tue, 2 Jan 2018 23:53:14 +0100
Subject: Error.c: remove empty ifdef

---
 nx-X11/programs/Xserver/hw/nxagent/Error.c | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/nx-X11/programs/Xserver/hw/nxagent/Error.c b/nx-X11/programs/Xserver/hw/nxagent/Error.c
index c56275922..31bf7541c 100644
--- a/nx-X11/programs/Xserver/hw/nxagent/Error.c
+++ b/nx-X11/programs/Xserver/hw/nxagent/Error.c
@@ -414,10 +414,6 @@ char *nxagentGetRootPath(void)
 
       if (homeEnv == NULL)
       {
-
-        #ifdef PANIC
-        #endif
-
         return NULL;
       }
 
-- 
cgit v1.2.3


From 654422a04824f4cb4d789c1f4cf75862897ea9c1 Mon Sep 17 00:00:00 2001
From: Ulrich Sibiller <uli42@gmx.de>
Date: Wed, 3 Jan 2018 00:05:09 +0100
Subject: Error.c: remove trailing whitespace

and insert one single space
---
 nx-X11/programs/Xserver/hw/nxagent/Error.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/nx-X11/programs/Xserver/hw/nxagent/Error.c b/nx-X11/programs/Xserver/hw/nxagent/Error.c
index 31bf7541c..34bfdf414 100644
--- a/nx-X11/programs/Xserver/hw/nxagent/Error.c
+++ b/nx-X11/programs/Xserver/hw/nxagent/Error.c
@@ -102,7 +102,7 @@ void nxagentGetClientsPath(void);
 
 static int nxagentPrintError(Display *dpy, XErrorEvent *event, FILE *fp);
 
-/* declare an error handler that does not exit when an error 
+/* declare an error handler that does not exit when an error
  * event is catched.
  */
 
@@ -171,7 +171,7 @@ static int nxagentPrintError(dpy, event, fp)
 	buffer[0] = '\0';
 	/*
 	for (ext = dpy->ext_procs; ext; ext = ext->next) {
-	    if (ext->error_string) 
+	    if (ext->error_string)
 		(*ext->error_string)(dpy, event->error_code, &ext->codes,
 				     buffer, BUFSIZ);
 	    if (buffer[0]) {
@@ -182,7 +182,7 @@ static int nxagentPrintError(dpy, event, fp)
 		ext->codes.first_error < (int)event->error_code &&
 		(!bext || ext->codes.first_error > bext->codes.first_error))
 		bext = ext;
-	}    
+	}
 	if (bext)
 	    sprintf(buffer, "%s.%d", bext->name,
 		    event->error_code - bext->codes.first_error);
@@ -225,7 +225,7 @@ static int nxagentPrintError(dpy, event, fp)
 	(void) fprintf(fp, mesg, event->resourceid);
 	fputs("\n", fp);
     }
-    XGetErrorDatabaseText(dpy, mtype, "ErrorSerial", "Error Serial #%d", 
+    XGetErrorDatabaseText(dpy, mtype, "ErrorSerial", "Error Serial #%d",
 			  mesg, BUFSIZ);
     fputs("  ", fp);
     (void) fprintf(fp, mesg, event->serial);
@@ -252,7 +252,7 @@ void nxagentOpenClientsLogFile()
     nxagentGetClientsPath();
   }
 
-  if (nxagentClientsLogName != NULL && *nxagentClientsLogName !='\0')
+  if (nxagentClientsLogName != NULL && *nxagentClientsLogName != '\0')
   {
     nxagentClientsLog = open(nxagentClientsLogName, O_RDWR | O_CREAT | O_APPEND, 0600);
 
-- 
cgit v1.2.3


From 7d87e5a0c009e57f484a21f2c47d84574db7847f Mon Sep 17 00:00:00 2001
From: Ulrich Sibiller <uli42@gmx.de>
Date: Wed, 3 Jan 2018 00:05:49 +0100
Subject: Error.c: use standard file descriptor macros

---
 nx-X11/programs/Xserver/hw/nxagent/Error.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/nx-X11/programs/Xserver/hw/nxagent/Error.c b/nx-X11/programs/Xserver/hw/nxagent/Error.c
index 34bfdf414..4a80ec5ad 100644
--- a/nx-X11/programs/Xserver/hw/nxagent/Error.c
+++ b/nx-X11/programs/Xserver/hw/nxagent/Error.c
@@ -283,12 +283,12 @@ void nxagentStartRedirectToClientsLog(void)
   {
     if (nxagentStderrBackup == -1)
     {
-      nxagentStderrBackup = dup(2);
+      nxagentStderrBackup = dup(STDERR_FILENO);
     }
 
     if (nxagentStderrBackup != -1)
     {
-      nxagentStderrDup = dup2(nxagentClientsLog, 2);
+      nxagentStderrDup = dup2(nxagentClientsLog, STDERR_FILENO);
 
       if (nxagentStderrDup == -1)
       {
@@ -308,7 +308,7 @@ void nxagentEndRedirectToClientsLog(void)
 {
   if (nxagentStderrBackup != -1)
   {
-    nxagentStderrDup = dup2(nxagentStderrBackup, 2);
+    nxagentStderrDup = dup2(nxagentStderrBackup, STDERR_FILENO);
 
     if (nxagentStderrDup == -1)
     {
-- 
cgit v1.2.3


From 525e151681ec93657f027645ff0d8e0d487d6abf Mon Sep 17 00:00:00 2001
From: Ulrich Sibiller <uli42@gmx.de>
Date: Wed, 3 Jan 2018 00:06:39 +0100
Subject: Error.c: replace strcpy/strcat by snprintf

---
 nx-X11/programs/Xserver/hw/nxagent/Display.c |  3 +--
 nx-X11/programs/Xserver/hw/nxagent/Error.c   | 31 +++++++++++-----------------
 2 files changed, 13 insertions(+), 21 deletions(-)

diff --git a/nx-X11/programs/Xserver/hw/nxagent/Display.c b/nx-X11/programs/Xserver/hw/nxagent/Display.c
index b78530e37..31efab8c3 100644
--- a/nx-X11/programs/Xserver/hw/nxagent/Display.c
+++ b/nx-X11/programs/Xserver/hw/nxagent/Display.c
@@ -1873,8 +1873,7 @@ static FILE *nxagentLookForIconFile(char *iconName, const char *permission,
     /* append slash and icon name */
     if (strlen(singlePath) + strlen(iconName) + 1 < sizeof(singlePath))
     {
-      strncat(singlePath, slash, 1);
-      strcat(singlePath, iconName);
+      snprintf(singlePath + strlen(singlePath), sizeof(singlePath), "%s%s", slash, iconName);
 
       if ((fptr = fopen(singlePath, permission)) != NULL)
       {
diff --git a/nx-X11/programs/Xserver/hw/nxagent/Error.c b/nx-X11/programs/Xserver/hw/nxagent/Error.c
index 4a80ec5ad..7420a8b3d 100644
--- a/nx-X11/programs/Xserver/hw/nxagent/Error.c
+++ b/nx-X11/programs/Xserver/hw/nxagent/Error.c
@@ -359,14 +359,14 @@ char *nxagentGetHomePath(void)
       #endif
     }
 
-    strncpy(nxagentHomeDir, homeEnv, DEFAULT_STRING_LENGTH - 1);
+    snprintf(nxagentHomeDir, DEFAULT_STRING_LENGTH, "%s", homeEnv);
 
     #ifdef TEST
     fprintf(stderr, "nxagentGetHomePath: Assuming NX user's home directory '%s'.\n", nxagentHomeDir);
     #endif
   }
 
-  homePath = (char*) malloc(strlen(nxagentHomeDir) + 1);
+  homePath = strdup(nxagentHomeDir);
 
   if (homePath == NULL)
   {
@@ -377,8 +377,6 @@ char *nxagentGetHomePath(void)
     return NULL;
   }
 
-  strcpy(homePath, nxagentHomeDir);
-
   return homePath;
 }
 
@@ -434,8 +432,7 @@ char *nxagentGetRootPath(void)
       fprintf(stderr, "nxagentGetRootPath: Assuming NX root directory in '%s'.\n", homeEnv);
       #endif
 
-      strcpy(nxagentRootDir, homeEnv);
-      strcat(nxagentRootDir, "/.nx");
+      snprintf(nxagentRootDir, DEFAULT_STRING_LENGTH, "%s/.nx", homeEnv);
 
       free(homeEnv);
 
@@ -468,17 +465,17 @@ char *nxagentGetRootPath(void)
         return NULL;
       }
 
-      strcpy(nxagentRootDir, rootEnv);
+      snprintf(nxagentRootDir, DEFAULT_STRING_LENGTH, "%s", rootEnv);
     }
 
     #ifdef TEST
     fprintf(stderr, "nxagentGetRootPath: Assuming NX root directory '%s'.\n",
                 nxagentRootDir);
     #endif
-        
+
   }
 
-  rootPath = malloc(strlen(nxagentRootDir) + 1);
+  rootPath = strdup(nxagentRootDir);
 
   if (rootPath == NULL)
   {
@@ -489,8 +486,6 @@ char *nxagentGetRootPath(void)
     return NULL;
   }
 
-  strcpy(rootPath, nxagentRootDir);
-
   return rootPath;
 }
 
@@ -527,9 +522,7 @@ char *nxagentGetSessionPath(void)
       return NULL;
     }
 
-    strcpy(nxagentSessionDir, rootPath);
-
-    free(rootPath);
+    snprintf(nxagentSessionDir, DEFAULT_STRING_LENGTH, "%s", rootPath);
 
     if (strlen(nxagentSessionDir) + strlen("/C-") + strlen(nxagentSessionId) > DEFAULT_STRING_LENGTH - 1)
     {
@@ -538,12 +531,14 @@ char *nxagentGetSessionPath(void)
                   nxagentSessionDir);
       #endif
 
+      free(rootPath);
+
       return NULL;
     }
 
-    strcat(nxagentSessionDir, "/C-");
+    snprintf(nxagentSessionDir, DEFAULT_STRING_LENGTH, "%s/C-%s", rootPath, nxagentSessionId);
 
-    strcat(nxagentSessionDir, nxagentSessionId);
+    free(rootPath);
 
     if ((stat(nxagentSessionDir, &dirStat) == -1) && (errno == ENOENT))
     {
@@ -605,9 +600,7 @@ void nxagentGetClientsPath()
       return;
     }
 
-    strcpy(nxagentClientsLogName, sessionPath);
-
-    strcat(nxagentClientsLogName, "/clients");
+    snprintf(nxagentClientsLogName, DEFAULT_STRING_LENGTH, "%s/clients", sessionPath);
 
     free(sessionPath);
   }
-- 
cgit v1.2.3


From 96e430069b24e0a4cd53e47e38786802999d31f4 Mon Sep 17 00:00:00 2001
From: Ulrich Sibiller <uli42@gmx.de>
Date: Wed, 3 Jan 2018 00:18:39 +0100
Subject: Error.c: update nxagentPrintError

This is a partial copy from XlibInt.c's _XPrintDefaultError, which had
some minor changes since being copied. Update to reflect these
changes. Also comment some more lines as their result was unused an
cluttered the output.
---
 nx-X11/programs/Xserver/hw/nxagent/Error.c | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/nx-X11/programs/Xserver/hw/nxagent/Error.c b/nx-X11/programs/Xserver/hw/nxagent/Error.c
index 7420a8b3d..4493840d4 100644
--- a/nx-X11/programs/Xserver/hw/nxagent/Error.c
+++ b/nx-X11/programs/Xserver/hw/nxagent/Error.c
@@ -118,6 +118,8 @@ int nxagentErrorHandler(Display *dpy, XErrorEvent *event)
 
 /* copied from XlibInt.c */
 /* extension stuff roughly commented out */
+/* FIXME: why? What's wrong with printing extension stuff?
+   We could drop this in favour of _XprintDefaultError then! */
 static int nxagentPrintError(dpy, event, fp)
     Display *dpy;
     XErrorEvent *event;
@@ -138,7 +140,7 @@ static int nxagentPrintError(dpy, event, fp)
 	mesg, BUFSIZ);
     (void) fprintf(fp, mesg, event->request_code);
     if (event->request_code < 128) {
-	sprintf(number, "%d", event->request_code);
+	snprintf(number, sizeof(number), "%d", event->request_code);
 	XGetErrorDatabaseText(dpy, "XRequest", number, "", buffer, BUFSIZ);
     } else {
       /*	for (ext = dpy->ext_procs;
@@ -146,7 +148,7 @@ static int nxagentPrintError(dpy, event, fp)
 	     ext = ext->next)
 	  ;
 	if (ext)
-	    strcpy(buffer, ext->name);
+	    strncpy(buffer, ext->name, BUFSIZ);
 	else
       */
 	    buffer[0] = '\0';
@@ -159,7 +161,7 @@ static int nxagentPrintError(dpy, event, fp)
 	(void) fprintf(fp, mesg, event->minor_code);
 	/*
 	if (ext) {
-	    sprintf(mesg, "%s.%d", ext->name, event->minor_code);
+	    snprintf(mesg, sizeof(mesg), "%s.%d", ext->name, event->minor_code);
 	    XGetErrorDatabaseText(dpy, "XRequest", mesg, "", buffer, BUFSIZ);
 	    (void) fprintf(fp, " (%s)", buffer);
 	}
@@ -184,7 +186,7 @@ static int nxagentPrintError(dpy, event, fp)
 		bext = ext;
 	}
 	if (bext)
-	    sprintf(buffer, "%s.%d", bext->name,
+	    snprintf(buffer, sizeof(buffer), "%s.%d", bext->name,
 		    event->error_code - bext->codes.first_error);
 	else
 	*/
@@ -229,10 +231,10 @@ static int nxagentPrintError(dpy, event, fp)
 			  mesg, BUFSIZ);
     fputs("  ", fp);
     (void) fprintf(fp, mesg, event->serial);
-    XGetErrorDatabaseText(dpy, mtype, "CurrentSerial", "Current Serial #%d",
+    /*    XGetErrorDatabaseText(dpy, mtype, "CurrentSerial", "Current Serial #%d",
 			  mesg, BUFSIZ);
     fputs("\n  ", fp);
-    /*    (void) fprintf(fp, mesg, dpy->request); */
+    (void) fprintf(fp, mesg, dpy->request); */
     fputs("\n", fp);
     if (event->error_code == BadImplementation) return 0;
     return 1;
-- 
cgit v1.2.3


From dc61b6ccacb0cd535e125f6e3831c5d0b3d073b4 Mon Sep 17 00:00:00 2001
From: Ulrich Sibiller <uli42@gmx.de>
Date: Wed, 3 Jan 2018 00:32:14 +0100
Subject: Args.c: use strdup instead of malloc

---
 nx-X11/programs/Xserver/hw/nxagent/Args.c | 42 ++++++-------------------------
 1 file changed, 7 insertions(+), 35 deletions(-)

diff --git a/nx-X11/programs/Xserver/hw/nxagent/Args.c b/nx-X11/programs/Xserver/hw/nxagent/Args.c
index 8ee64ba75..6c0160164 100644
--- a/nx-X11/programs/Xserver/hw/nxagent/Args.c
+++ b/nx-X11/programs/Xserver/hw/nxagent/Args.c
@@ -215,14 +215,10 @@ int ddxProcessArgument(int argc, char *argv[], int i)
     {
       if ((!strcmp(argv[j], "-display")) && (j + 1 < argc))
       {
-        envOptions = malloc(strlen(argv[j + 1]) + 1);
+        envOptions = strdup(argv[j + 1]);
 
-        if (envOptions != NULL)
-        {
-          envOptions = strcpy(envOptions, argv[j + 1]);
-        }
         #ifdef WARNING
-        else
+        if (envOptions == NULL)
         {
           fprintf(stderr, "ddxProcessArgument: WARNING! failed string allocation.\n");
         }
@@ -234,14 +230,10 @@ int ddxProcessArgument(int argc, char *argv[], int i)
 
     if ((envOptions == NULL) && (envDisplay != NULL))
     {
-      envOptions = malloc(strlen(envDisplay) + 1);
+      envOptions = strdup(envDisplay);
 
-      if (envOptions != NULL)
-      {
-        envOptions = strcpy(envOptions, envDisplay);
-      }
       #ifdef WARNING
-      else
+      if (envOptions == NULL)
       {
         fprintf(stderr, "ddxProcessArgument: WARNING! failed string allocation.\n");
       }
@@ -696,34 +688,14 @@ int ddxProcessArgument(int argc, char *argv[], int i)
   {
     if (++i < argc)
     {
-      int size;
-
       free(nxagentKeyboard);
       nxagentKeyboard = NULL;
 
-      if ((size = strlen(argv[i])) < 256)
-      {
-        if ((nxagentKeyboard = malloc(size + 1)) == NULL)
-        {
-          FatalError("malloc failed");
-        }
-
-        strncpy(nxagentKeyboard, argv[i], size);
-
-        nxagentKeyboard[size] = '\0';
-      }
-      #ifdef WARNING
-      else
+      nxagentKeyboard = strdup(argv[i]);
+      if (nxagentKeyboard == NULL)
       {
-        /*
-         * it is useless to remember a kbtype
-         * option that has just been truncated.
-         */
-
-        fprintf(stderr, "ddxProcessArgument: WARNING! Option [%s] too long. "
-                    "It will be ignored.\n", argv[i]);
+        FatalError("malloc failed");
       }
-      #endif
 
       return 2;
     }
-- 
cgit v1.2.3


From 74c21e9e2dee66dcc3b5224081440fb2351e4d4c Mon Sep 17 00:00:00 2001
From: Ulrich Sibiller <uli42@gmx.de>
Date: Wed, 3 Jan 2018 00:59:20 +0100
Subject: Args.c, Error.[ch]: introduce own length macro for
 nxagentClientsLogName

---
 nx-X11/programs/Xserver/hw/nxagent/Args.c  | 2 +-
 nx-X11/programs/Xserver/hw/nxagent/Error.c | 6 +++---
 nx-X11/programs/Xserver/hw/nxagent/Error.h | 3 ++-
 3 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/nx-X11/programs/Xserver/hw/nxagent/Args.c b/nx-X11/programs/Xserver/hw/nxagent/Args.c
index 6c0160164..ee18f3b0d 100644
--- a/nx-X11/programs/Xserver/hw/nxagent/Args.c
+++ b/nx-X11/programs/Xserver/hw/nxagent/Args.c
@@ -1254,7 +1254,7 @@ static void nxagentParseOptions(char *name, char *value)
   }
   else if (strcmp(name, "clients") == 0)
   {
-    strcpy(nxagentClientsLogName, value);
+    snprintf(nxagentClientsLogName, NXAGENTCLIENTSLOGNAMELENGTH, "%s", value);
 
     return;
   }
diff --git a/nx-X11/programs/Xserver/hw/nxagent/Error.c b/nx-X11/programs/Xserver/hw/nxagent/Error.c
index 4493840d4..7abd83ae3 100644
--- a/nx-X11/programs/Xserver/hw/nxagent/Error.c
+++ b/nx-X11/programs/Xserver/hw/nxagent/Error.c
@@ -78,7 +78,7 @@ static int nxagentClientsLog = -1;
  * Clients log file name.
  */
 
-char nxagentClientsLogName[DEFAULT_STRING_LENGTH] = { 0 };
+char nxagentClientsLogName[NXAGENTCLIENTSLOGNAMELENGTH] = { 0 };
 
 /*
  * User's home.
@@ -591,7 +591,7 @@ void nxagentGetClientsPath()
       return;
     }
 
-    if (strlen(sessionPath) + strlen("/clients") > DEFAULT_STRING_LENGTH - 1)
+    if (strlen(sessionPath) + strlen("/clients") > NXAGENTCLIENTSLOGNAMELENGTH - 1)
     {
       #ifdef PANIC
       fprintf(stderr, "nxagentGetClientsPath: PANIC! Invalid value for the NX clients Log File Path ''.\n");
@@ -602,7 +602,7 @@ void nxagentGetClientsPath()
       return;
     }
 
-    snprintf(nxagentClientsLogName, DEFAULT_STRING_LENGTH, "%s/clients", sessionPath);
+    snprintf(nxagentClientsLogName, NXAGENTCLIENTSLOGNAMELENGTH, "%s/clients", sessionPath);
 
     free(sessionPath);
   }
diff --git a/nx-X11/programs/Xserver/hw/nxagent/Error.h b/nx-X11/programs/Xserver/hw/nxagent/Error.h
index 1d0d9a827..f23385e0a 100644
--- a/nx-X11/programs/Xserver/hw/nxagent/Error.h
+++ b/nx-X11/programs/Xserver/hw/nxagent/Error.h
@@ -30,7 +30,8 @@
  * Clients log file name.
  */
 
-extern char nxagentClientsLogName[];
+#define NXAGENTCLIENTSLOGNAMELENGTH 256
+extern char nxagentClientsLogName[NXAGENTCLIENTSLOGNAMELENGTH];
 
 extern char nxagentVerbose;
 
-- 
cgit v1.2.3


From cac1af52d93222e3705ea20f999ba7178010963e Mon Sep 17 00:00:00 2001
From: Ulrich Sibiller <uli42@gmx.de>
Date: Wed, 3 Jan 2018 00:59:59 +0100
Subject: Args.c: simplify nxagentGetDialogName()

---
 nx-X11/programs/Xserver/hw/nxagent/Args.c | 15 ++++-----------
 1 file changed, 4 insertions(+), 11 deletions(-)

diff --git a/nx-X11/programs/Xserver/hw/nxagent/Args.c b/nx-X11/programs/Xserver/hw/nxagent/Args.c
index ee18f3b0d..14f696e2d 100644
--- a/nx-X11/programs/Xserver/hw/nxagent/Args.c
+++ b/nx-X11/programs/Xserver/hw/nxagent/Args.c
@@ -2098,31 +2098,24 @@ void ddxUseMsg()
 
 static int nxagentGetDialogName()
 {
-  snprintf(nxagentDialogName, NXAGENTDIALOGNAMELENGTH, "NX");
-
   if (*nxagentSessionId != '\0')
   {
     int length = strlen(nxagentSessionId);
 
-    strcpy(nxagentDialogName, "NX - ");
-
     /* if the session id contains an MD5 hash in a well-known format cut it off */
     if (length > (MD5_LENGTH * 2 + 1) &&
            *(nxagentSessionId + (length - (MD5_LENGTH * 2 + 1))) == '-')
     {
-      strncat(nxagentDialogName, nxagentSessionId,
-              MIN(NXAGENTDIALOGNAMELENGTH - strlen(nxagentDialogName), length - (MD5_LENGTH * 2 + 1)) - 1);
-    }
-    else
-    {
-      strncat(nxagentDialogName, nxagentSessionId, NXAGENTDIALOGNAMELENGTH - strlen(nxagentDialogName) - 1);
+      length -= (MD5_LENGTH * 2 + 1);
     }
 
-    nxagentDialogName[NXAGENTDIALOGNAMELENGTH - 1] = '\0';
+    snprintf(nxagentDialogName, NXAGENTDIALOGNAMELENGTH, "NX - %.*s", length, nxagentSessionId);
 
     return 1;
   }
 
+  snprintf(nxagentDialogName, NXAGENTDIALOGNAMELENGTH, "NX");
+
   return 0;
 }
 
-- 
cgit v1.2.3


From 56fa234856428ca2de92c27904edb1fe28bc4fdc Mon Sep 17 00:00:00 2001
From: Ulrich Sibiller <uli42@gmx.de>
Date: Wed, 3 Jan 2018 01:11:34 +0100
Subject: Font.c: replace memcpy by sprintf preventing possible buffer
 overflows

I am not sure about the maximum font name length in X but just in
case use snprintf instead of memcpy to be sure nothing dangerous can
happen here.
---
 nx-X11/programs/Xserver/hw/nxagent/Font.c | 12 +++---------
 1 file changed, 3 insertions(+), 9 deletions(-)

diff --git a/nx-X11/programs/Xserver/hw/nxagent/Font.c b/nx-X11/programs/Xserver/hw/nxagent/Font.c
index 5a9b729ed..540ad79e2 100644
--- a/nx-X11/programs/Xserver/hw/nxagent/Font.c
+++ b/nx-X11/programs/Xserver/hw/nxagent/Font.c
@@ -733,7 +733,7 @@ static XFontStruct *nxagentLoadBestQueryFont(Display* dpy, char *fontName, FontP
 {
   XFontStruct *fontStruct;
 
-  char *substFontBuf;
+  char substFontBuf[512];;
 
   /*  X Logical Font Description Conventions
    *  require 14 fields in the font names.
@@ -767,12 +767,9 @@ static XFontStruct *nxagentLoadBestQueryFont(Display* dpy, char *fontName, FontP
   fprintf(stderr, "nxagentLoadBestQueryFont: Searching font '%s' .\n", fontName);
   #endif
 
-  substFontBuf = (char *) malloc(sizeof(char) * 512);
-
-
   numFontFields = nxagentSplitString(fontName, fontNameFields, FIELDS + 1, "-");
 
-  memcpy(substFontBuf, "fixed\0", strlen("fixed") + 1);
+  snprintf(substFontBuf, sizeof(substFontBuf), "%s", "fixed");
 
   if (numFontFields <= FIELDS)
   {
@@ -831,8 +828,7 @@ static XFontStruct *nxagentLoadBestQueryFont(Display* dpy, char *fontName, FontP
         /* Found more accurate font  */
 
         weight = tempWeight;
-        memcpy(substFontBuf, nxagentRemoteFontList.list[i]->name, strlen(nxagentRemoteFontList.list[i]->name));
-        substFontBuf[strlen(nxagentRemoteFontList.list[i]->name)] = '\0';
+        snprintf(substFontBuf, sizeof(substFontBuf), "%s", nxagentRemoteFontList.list[i]->name);
 
         #ifdef NXAGENT_RECONNECT_FONT_DEBUG
         fprintf(stderr, "nxagentLoadBestQueryFont: Weight '%d' of more accurate font '%s' .\n", weight, substFontBuf);
@@ -856,8 +852,6 @@ static XFontStruct *nxagentLoadBestQueryFont(Display* dpy, char *fontName, FontP
 
   fontStruct = nxagentLoadQueryFont(dpy, substFontBuf, pFont);
 
-  free (substFontBuf);
-
   for (j = 0; j < numFontFields; j++)
   {
     free(fontNameFields[j]);
-- 
cgit v1.2.3


From 054ae844758a306df4aacd40c46780195853a8f8 Mon Sep 17 00:00:00 2001
From: Ulrich Sibiller <uli42@gmx.de>
Date: Wed, 3 Jan 2018 01:17:59 +0100
Subject: Font.c: free possibly allocated mem

even if we issue a FatalError afterwards
---
 nx-X11/programs/Xserver/hw/nxagent/Font.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/nx-X11/programs/Xserver/hw/nxagent/Font.c b/nx-X11/programs/Xserver/hw/nxagent/Font.c
index 540ad79e2..197f0c84a 100644
--- a/nx-X11/programs/Xserver/hw/nxagent/Font.c
+++ b/nx-X11/programs/Xserver/hw/nxagent/Font.c
@@ -916,6 +916,11 @@ static void nxagentCollectFailedFont(FontPtr fpt, XID id)
 
     if (nxagentFailedToReconnectFonts.font == NULL || nxagentFailedToReconnectFonts.id == NULL)
     {
+      free(nxagentFailedToReconnectFonts.font);
+      nxagentFailedToReconnectFonts.font = NULL;
+      free(nxagentFailedToReconnectFonts.id);
+      nxagentFailedToReconnectFonts.id = NULL;
+
       FatalError("Font: font not reconnected memory allocation failed!.\n");
     }
 
-- 
cgit v1.2.3


From 1854700722db8067460e82a711521fdb27fb51d4 Mon Sep 17 00:00:00 2001
From: Ulrich Sibiller <uli42@gmx.de>
Date: Wed, 3 Jan 2018 01:31:52 +0100
Subject: Font.c: replace malloc + strcpy by strdup + fix memleak

---
 nx-X11/programs/Xserver/hw/nxagent/Font.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/nx-X11/programs/Xserver/hw/nxagent/Font.c b/nx-X11/programs/Xserver/hw/nxagent/Font.c
index 197f0c84a..5af88b137 100644
--- a/nx-X11/programs/Xserver/hw/nxagent/Font.c
+++ b/nx-X11/programs/Xserver/hw/nxagent/Font.c
@@ -334,10 +334,12 @@ void nxagentListRemoteAddName(const char *name, int status)
 
   if ((nxagentRemoteFontList.list[pos] = malloc(sizeof(nxagentFontRec))))
   {
-    nxagentRemoteFontList.list[pos]->name = malloc(strlen(name) +1);
+    nxagentRemoteFontList.list[pos]->name = strdup(name);
     if (nxagentRemoteFontList.list[pos]->name == NULL)
     {
        fprintf(stderr, "Font: remote list name memory allocation failed!.\n");
+       free(nxagentRemoteFontList.list[pos]);
+       nxagentRemoteFontList.list[pos] = NULL;
        return;
     }
   }
@@ -346,7 +348,6 @@ void nxagentListRemoteAddName(const char *name, int status)
      fprintf(stderr, "Font: remote list record memory allocation failed!.\n");
      return;
   }
-  strcpy(nxagentRemoteFontList.list[pos]->name,name);
   nxagentRemoteFontList.list[pos]->status = status;
   nxagentRemoteFontList.length++;
 
-- 
cgit v1.2.3


From a0e985fb6d28c1ef551823e3b2a013b29192ac02 Mon Sep 17 00:00:00 2001
From: Ulrich Sibiller <uli42@gmx.de>
Date: Wed, 3 Jan 2018 01:55:32 +0100
Subject: Keystroke.c: replace calloc + 2 * strcpy by asprintf

---
 nx-X11/programs/Xserver/hw/nxagent/Keystroke.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/nx-X11/programs/Xserver/hw/nxagent/Keystroke.c b/nx-X11/programs/Xserver/hw/nxagent/Keystroke.c
index f790090bf..61b4512fb 100644
--- a/nx-X11/programs/Xserver/hw/nxagent/Keystroke.c
+++ b/nx-X11/programs/Xserver/hw/nxagent/Keystroke.c
@@ -324,13 +324,11 @@ void nxagentInitKeystrokes(Bool force)
   char *homedir = getenv("HOME");
   if (homedir)
   {
-    if (!(homepath = calloc(1, strlen(homedir) + strlen(homefile) + 1)))
+    if (-1 == asprintf(&homepath, "%s%s", homedir, homefile))
     {
       fprintf(stderr, "malloc failed");
       exit(EXIT_FAILURE);
     }
-    strcpy(homepath, homedir);
-    strcpy(homepath + strlen(homedir), homefile);
   }
 
   /* if any of the files can be read we have our candidate */
-- 
cgit v1.2.3


From 11b2b067e017c55f9b1b275671198336847f14e0 Mon Sep 17 00:00:00 2001
From: Ulrich Sibiller <uli42@gmx.de>
Date: Wed, 3 Jan 2018 02:22:11 +0100
Subject: Keyboard.c: rework string allocation/building

---
 nx-X11/programs/Xserver/hw/nxagent/Keyboard.c | 24 ++++++++++--------------
 1 file changed, 10 insertions(+), 14 deletions(-)

diff --git a/nx-X11/programs/Xserver/hw/nxagent/Keyboard.c b/nx-X11/programs/Xserver/hw/nxagent/Keyboard.c
index cddb3457e..3acf498ff 100644
--- a/nx-X11/programs/Xserver/hw/nxagent/Keyboard.c
+++ b/nx-X11/programs/Xserver/hw/nxagent/Keyboard.c
@@ -534,7 +534,6 @@ static void nxagentCheckXkbBaseDirectory(void)
 static char *nxagentXkbGetRules()
 {
   int ret;
-  int size, sizeDflt, sizeAlt;
   char *path;
   struct stat buf;
 
@@ -543,19 +542,11 @@ static char *nxagentXkbGetRules()
               XkbBaseDirectory);
   #endif
 
-  sizeDflt = strlen(XKB_DFLT_RULES_FILE);
-  sizeAlt = strlen(XKB_ALTS_RULES_FILE);
-  size = strlen(XkbBaseDirectory) + strlen("/rules/");
-  size += (sizeDflt > sizeAlt) ? sizeDflt : sizeAlt;
-
-  if ((path = malloc((size + 1) * sizeof(char))) == NULL)
+  if (-1 == asprintf(&path, "%s/rules/%s", XkbBaseDirectory, XKB_DFLT_RULES_FILE))
   {
     FatalError("nxagentXkbGetRules: malloc failed.");
   }
 
-  strcpy(path, XkbBaseDirectory);
-  strcat(path, "/rules/");
-  strcat(path, XKB_DFLT_RULES_FILE);
   #ifdef TEST
   fprintf(stderr, "nxagentXkbGetRules: checking rules file [%s]\n", path);
   #endif
@@ -572,11 +563,16 @@ static char *nxagentXkbGetRules()
 
   #ifdef TEST
   fprintf(stderr, "nxagentXkbGetRules: WARNING! Failed to stat file [%s]: %s.\n", path, strerror(ret));
-  #endif 
+  #endif
+
+  free(path);
+  path = NULL;
+
+  if (-1 == asprintf(&path, "%s/rules/%s", XkbBaseDirectory, XKB_ALTS_RULES_FILE))
+  {
+    FatalError("nxagentXkbGetRules: malloc failed.");
+  }
 
-  strcpy(path, XkbBaseDirectory);
-  strcat(path, "/rules/");
-  strcat(path, XKB_ALTS_RULES_FILE);
   #ifdef TEST
   fprintf(stderr, "nxagentXkbGetRules: checking rules file [%s]\n", path);
   #endif
-- 
cgit v1.2.3


From 27a31d0ce3abc533b7e88932667a4b84e838dbff Mon Sep 17 00:00:00 2001
From: Ulrich Sibiller <uli42@gmx.de>
Date: Wed, 3 Jan 2018 02:29:55 +0100
Subject: Events.c: add FIXME

---
 nx-X11/programs/Xserver/hw/nxagent/Events.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/nx-X11/programs/Xserver/hw/nxagent/Events.c b/nx-X11/programs/Xserver/hw/nxagent/Events.c
index c186c1508..0b6e0cafb 100644
--- a/nx-X11/programs/Xserver/hw/nxagent/Events.c
+++ b/nx-X11/programs/Xserver/hw/nxagent/Events.c
@@ -2198,6 +2198,7 @@ FIXME: Don't enqueue the KeyRelease event if the key was
       char *kbdargs[6];
 
       strcpy(kbddisplay,":");
+      /* FIXME: why limit to 4? */
       strncat(kbddisplay, display, 4);
 
       kbdargs[0] = "nxkbd";
-- 
cgit v1.2.3


From b89b8094934856ae2f2b0e3bca83d3fe171f87b9 Mon Sep 17 00:00:00 2001
From: Ulrich Sibiller <uli42@gmx.de>
Date: Wed, 3 Jan 2018 02:34:10 +0100
Subject: Error.c: replace malloc+strcpy by strdup

---
 nx-X11/programs/Xserver/hw/nxagent/Error.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/nx-X11/programs/Xserver/hw/nxagent/Error.c b/nx-X11/programs/Xserver/hw/nxagent/Error.c
index 7abd83ae3..f5fb297b3 100644
--- a/nx-X11/programs/Xserver/hw/nxagent/Error.c
+++ b/nx-X11/programs/Xserver/hw/nxagent/Error.c
@@ -524,6 +524,7 @@ char *nxagentGetSessionPath(void)
       return NULL;
     }
 
+    /* FIXME: necessary? */
     snprintf(nxagentSessionDir, DEFAULT_STRING_LENGTH, "%s", rootPath);
 
     if (strlen(nxagentSessionDir) + strlen("/C-") + strlen(nxagentSessionId) > DEFAULT_STRING_LENGTH - 1)
@@ -562,9 +563,9 @@ char *nxagentGetSessionPath(void)
 
   }
 
-  sessionPath = malloc(strlen(nxagentSessionDir) + 1);
+  sessionPath = strdup(nxagentSessionDir);
 
-  if (sessionPath  == NULL)
+  if (sessionPath == NULL)
   {
     #ifdef PANIC
     fprintf(stderr, "nxagentGetSessionPath:: PANIC! Can't allocate memory for the session path.\n");
@@ -573,9 +574,6 @@ char *nxagentGetSessionPath(void)
     return NULL;
   }
 
-
-  strcpy(sessionPath, nxagentSessionDir);
-
   return sessionPath;
 }
 
-- 
cgit v1.2.3


From 23c36c2d2c0d1ea85c1b638d71267c28522c08cd Mon Sep 17 00:00:00 2001
From: Ulrich Sibiller <uli42@gmx.de>
Date: Wed, 3 Jan 2018 22:28:43 +0100
Subject: Display.c: drop helper variable in loop

---
 nx-X11/programs/Xserver/hw/nxagent/Display.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/nx-X11/programs/Xserver/hw/nxagent/Display.c b/nx-X11/programs/Xserver/hw/nxagent/Display.c
index 31efab8c3..4f2e3c6d8 100644
--- a/nx-X11/programs/Xserver/hw/nxagent/Display.c
+++ b/nx-X11/programs/Xserver/hw/nxagent/Display.c
@@ -1834,9 +1834,9 @@ static FILE *nxagentLookForIconFile(char *iconName, const char *permission,
     return NULL;
   }
 
-  for (int breakLoop = False; breakLoop == False && fptr == NULL; )
+  for (char *end = path; end != NULL && fptr == NULL; )
   {
-    char *end = strchr(path, separator);
+    end = strchr(path, separator);
 
     /* separator found */
     if (end != NULL)
@@ -1860,8 +1860,6 @@ static FILE *nxagentLookForIconFile(char *iconName, const char *permission,
       }
 
       snprintf(singlePath, sizeof(singlePath), "%s", path);
-
-      breakLoop = True;
     }
 
     /* cut off trailing slashes, if any */
-- 
cgit v1.2.3