use strlcpy, memcpy and snprintf instead of strcpy, strncpy and sprintf

dir.c

@@ -1437,7 +1437,8 @@ ruby_brace_expand(const char *str, int flags, ruby_glob_func *func, VALUE arg)
     }
 
     if (lbrace && rbrace) {
-	char *buf = GLOB_ALLOC_N(char, strlen(s) + 1);
+	size_t len = strlen(s) + 1;
+	char *buf = GLOB_ALLOC_N(char, len);
 	long shift;
 
 	if (!buf) return -1;
@@ -1456,7 +1457,7 @@ ruby_brace_expand(const char *str, int flags, ruby_glob_func *func, VALUE arg)
 		Inc(p);
 	    }
 	    memcpy(buf+shift, t, p-t);
-	    strcpy(buf+shift+(p-t), rbrace+1);
+	    strlcpy(buf+shift+(p-t), rbrace+1, len-(shift+(p-t)));
 	    status = ruby_brace_expand(buf, flags, func, arg);
 	    if (status) break;
 	}

dln.c

@@ -24,12 +24,12 @@
 // In file.c
 int eaccess(const char *path, int mode);
 
-static int
+static size_t
 init_funcname_len(char **buf, const char *file)
 {
     char *p;
     const char *slash;
-    int len;
+    size_t len;
 
     /* Load the file as an object one */
     for (slash = file-1; *file; file++) /* Find position of last '/' */
@@ -53,13 +53,13 @@ init_funcname_len(char **buf, const char *file)
 }
 
 #define init_funcname(buf, file) do {\
-    int len = init_funcname_len(buf, file);\
+    size_t len = init_funcname_len(buf, file);\
     char *tmp = ALLOCA_N(char, len+1);\
     if (tmp == NULL) {\
 	xfree(*buf);\
 	rb_memerror();\
     }\
-    strcpy(tmp, *buf);\
+    strlcpy(tmp, *buf, len + 1);\
     xfree(*buf);\
     *buf = tmp;\
 } while (0)

parse.y

@@ -889,10 +889,10 @@ stmt		: keyword_alias fitem {lex_state = EXPR_FNAME;} fitem
 		| keyword_alias tGVAR tBACK_REF
 		    {
 		    /*%%%*/
-			char buf[3];
-
-			sprintf(buf, "$%c", (char)$3->nd_nth);
-			$$ = NEW_VALIAS($2, rb_intern(buf));
+			char buf[2];
+			buf[0] = '$';
+			buf[1] = (char)$3->nd_nth;
+			$$ = NEW_VALIAS($2, rb_intern2(buf, 2));
 		    /*%
 			$$ = dispatch2(var_alias, $2, $3);
 		    %*/
@@ -7105,7 +7105,7 @@ parser_yylex(struct parser_params *parser)
 	    if (nondigit) {
 		char tmp[30];
 	      trailing_uc:
-		sprintf(tmp, "trailing `%c' in number", nondigit);
+		snprintf(tmp, sizeof(tmp), "trailing `%c' in number", nondigit);
 		yyerror(tmp);
 	    }
 	    if (is_float) {
@@ -9750,9 +9750,9 @@ ripper_id2sym(ID id)
     char buf[8];
 
     if (id <= 256) {
-        buf[0] = id;
+        buf[0] = (char)id;
         buf[1] = '\0';
-        return ID2SYM(rb_intern(buf));
+        return ID2SYM(rb_intern2(buf, 1));
     }
     if ((name = keyword_id_to_str(id))) {
         return ID2SYM(rb_intern(name));

string.c

@@ -1733,7 +1733,7 @@ str_transcode(rb_str_t *self, rb_encoding_t *src_encoding, rb_encoding_t *dst_en
 			char *bytes_list = xmalloc(invalid_bytes_length * 4);
 			char *bytes_list_pos = bytes_list;
 			for (long i = 0; i < invalid_bytes_length; ++i) {
-			    sprintf(bytes_list_pos, "\\x%02X", (unsigned char)self->bytes[pos_in_src+i]);
+			    snprintf(bytes_list_pos, (invalid_bytes_length * 4), "\\x%02X", (unsigned char)self->bytes[pos_in_src+i]);
 			    bytes_list_pos += 4;
 			}
 			rb_raise(rb_eInvalidByteSequenceError, "\"%s\" on %s", bytes_list, src_encoding->public_name);

util.c

@@ -278,6 +278,7 @@ ruby_add_suffix(VALUE str, const char *suffix)
     char *s, *t, *p;
     long slen;
     char buf[1024];
+    char *const bufend = buf + sizeof(buf);
 
     if (RSTRING_LEN(str) > 1000)
         rb_fatal("Cannot do inplace edit on long filename (%ld characters)",
@@ -312,7 +313,7 @@ ruby_add_suffix(VALUE str, const char *suffix)
 
     if (*suffix == '.') {        /* Style 1 */
         if (strEQ(ext, suffix)) goto fallback;
-	strcpy(p, suffix);
+	strlcpy(p, suffix, bufend - p);
     }
     else if (suffix[1] == '\0') {  /* Style 2 */
         if (extlen < 4) { 
@@ -329,7 +330,7 @@ ruby_add_suffix(VALUE str, const char *suffix)
 	    buf[7] = *suffix;
 	}
 	else goto fallback;
-	strcpy(p, ext);
+	strcpy(p, ext, bufend - p);
     }
     else { /* Style 3:  Panic */
 fallback:

variable.c

@@ -496,10 +496,11 @@ global_id(const char *name)
 
     if (name[0] == '$') id = rb_intern(name);
     else {
-	char *buf = ALLOCA_N(char, strlen(name)+2);
+	size_t len = strlen(name);
+	char *buf = ALLOCA_N(char, len+1);
 	buf[0] = '$';
-	strcpy(buf+1, name);
-	id = rb_intern(buf);
+	memcpy(buf+1, name, len);
+	id = rb_intern2(buf, len+1);
     }
     return id;
 }
@@ -768,13 +769,14 @@ VALUE
 rb_f_global_variables(VALUE rcv, SEL sel)
 {
     VALUE ary = rb_ary_new();
-    char buf[4];
-    const char *s = "123456789";
+    char buf[2];
+    int i;
 
     st_foreach_safe(rb_global_tbl, gvar_i, ary);
-    while (*s) {
-	sprintf(buf, "$%c", *s++);
-	rb_ary_push(ary, ID2SYM(rb_intern(buf)));
+    buf[0] = '$';
+    for (i = 1; i <= 9; ++i) {
+	buf[1] = (char)(i + '0');
+	rb_ary_push(ary, ID2SYM(rb_intern2(buf, 2)));
     }
     return ary;
 }