ld: sprintf sanitizer null destination pointer

	* configure.ac (stpcpy): AC_CHECK_DECLS.
	* sysdep.h (stpcpy): Add fallback declaraion.
	* config.in: Regenerate.
	* configure: Regenerate.
	* emultempl/pe.em (open_dynamic_archive): Use
	stpcpy rather than sprintf plus strlen.
	* emultempl/pep.em (open_dynamic_archive): Likewise.
	* emultempl/xtensaelf.em (elf_xtensa_before_allocation): Use
	auto rather than malloc'd buffer.  Use sprintf count.
	* ldelf.c (ldelf_search_needed): Use memcpy in place of sprintf.
	* pe-dll.c (pe_process_import_defs): Use string already formed
	for alias match rather than recreating.

1 files changed, 7 insertions, 4 deletions

diff --git a/ld/ldelf.c b/ld/ldelf.c
index f9a6819..23a014d 100644
--- a/ld/ldelf.c
+++ b/ld/ldelf.c
@@ -524,10 +524,13 @@ ldelf_search_needed (const char *path, struct dt_needed *n, int force,
 		      else
 			{
 			  char * current_dir = getpwd ();
-
-			  freeme = xmalloc (strlen (replacement)
-					    + strlen (current_dir) + 2);
-			  sprintf (freeme, "%s/%s", current_dir, replacement);
+			  size_t cdir_len = strlen (current_dir);
+			  size_t rep_len = strlen (replacement);
+			  freeme = xmalloc (cdir_len + rep_len + 2);
+			  memcpy (freeme, current_dir, cdir_len);
+			  freeme[cdir_len] = '/';
+			  memcpy (freeme + cdir_len + 1,
+				  replacement, rep_len + 1);
 			}
 
 		      replacement = freeme;