tftp: use slirp_fmt0()

Make it OOB-safe, warn on truncation, always \0-end, abort on error.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Message-Id: <20200127092414.169796-5-marcandre.lureau@redhat.com>

1 files changed, 2 insertions, 6 deletions

diff --git a/src/tftp.c b/src/tftp.c
index 4d9ee1f..c209145 100644
--- a/src/tftp.c
+++ b/src/tftp.c
@@ -185,12 +185,8 @@ static int tftp_send_oack(struct tftp_session *spt, const char *keys[],
 
     tp->tp_op = htons(TFTP_OACK);
     for (i = 0; i < nb; i++) {
-        n += snprintf(tp->x.tp_buf + n, sizeof(tp->x.tp_buf) - n, "%s",
-                      keys[i]) +
-             1;
-        n += snprintf(tp->x.tp_buf + n, sizeof(tp->x.tp_buf) - n, "%u",
-                      values[i]) +
-             1;
+        n += slirp_fmt0(tp->x.tp_buf + n, sizeof(tp->x.tp_buf) - n, "%s", keys[i]);
+        n += slirp_fmt0(tp->x.tp_buf + n, sizeof(tp->x.tp_buf) - n, "%u", values[i]);
     }
 
     m->m_len = G_SIZEOF_MEMBER(struct tftp_t, tp_op) + n;