Switch to safe versions of string functions. (#504)

src/combine.cc

@@ -49,9 +49,7 @@ void parse_combine_arg(struct text_object *obj, const char *arg) {
   j = 0;
   for (i = 0; arg[i] != 0 && j < 2; i++) {
     if (startvar[j] == -1) {
-      if (arg[i] == '$') {
+      if (arg[i] == '$') { startvar[j] = i; }
-        startvar[j] = i;
-      }
     } else if (endvar[j] == -1) {
       if (arg[i] == '{') {
         indenting++;
@@ -104,6 +102,7 @@ void print_combine(struct text_object *obj, char *p, int p_max_size) {
   buf[0].resize(max_user_text.get(*state));
   buf[1].resize(max_user_text.get(*state));
   int i, j;
+  int p_len_remaining = p_max_size - 1;
   long longest = 0;
   int nextstart;
   int nr_rows[2];
@@ -114,9 +113,7 @@ void print_combine(struct text_object *obj, char *p, int p_max_size) {
   struct llrows *ll_rows[2], *current[2];
   struct text_object *objsub = obj->sub;
 
-  if ((cd == nullptr) || (p_max_size == 0)) {
+  if ((cd == nullptr) || (p_max_size == 0)) { return; }
-    return;
-  }
 
   p[0] = 0;
   for (i = 0; i < 2; i++) {
@@ -124,14 +121,10 @@ void print_combine(struct text_object *obj, char *p, int p_max_size) {
     nextstart = 0;
     ll_rows[i] = static_cast<struct llrows *>(malloc(sizeof(struct llrows)));
     current[i] = ll_rows[i];
-    for (j = 0; j < i; j++) {
+    for (j = 0; j < i; j++) { objsub = objsub->sub; }
-      objsub = objsub->sub;
-    }
     generate_text_internal(&(buf[i][0]), max_user_text.get(*state), *objsub);
     for (j = 0; buf[i][j] != 0; j++) {
-      if (buf[i][j] == '\t') {
+      if (buf[i][j] == '\t') { buf[i][j] = ' '; }
-        buf[i][j] = ' ';
-      }
       if (buf[i][j] == '\n') {
         buf[i][j] = 0;  // the vars inside combine may not have a \n at the end
       }
@@ -158,27 +151,30 @@ void print_combine(struct text_object *obj, char *p, int p_max_size) {
   }
   for (j = 0; j < (nr_rows[0] > nr_rows[1] ? nr_rows[0] : nr_rows[1]); j++) {
     if (current[0] != nullptr) {
-      strcat(p, current[0]->row);
+      strncat(p, current[0]->row, p_len_remaining);
+      p_len_remaining -= strlen(current[0]->row);
       i = strlen(current[0]->row);
     } else {
       i = 0;
     }
     while (i < longest) {
-      strcat(p, " ");
+      strncat(p, " ", p_len_remaining);
+      p_len_remaining -= 2;
       i++;
     }
     if (current[1] != nullptr) {
-      strcat(p, cd->seperation);
+      p_len_remaining -= strlen(cd->seperation);
-      strcat(p, current[1]->row);
+      strncat(p, cd->seperation, p_len_remaining);
+      p_len_remaining -= strlen(current[1]->row);
+      strncat(p, current[1]->row, p_len_remaining);
     }
-    strcat(p, "\n");
+    strncat(p, "\n", p_len_remaining);
+    p_len_remaining -= 2;
 #ifdef HAVE_OPENMP
 #pragma omp parallel for schedule(dynamic, 10)
 #endif /* HAVE_OPENMP */
     for (i = 0; i < 2; i++) {
-      if (current[i] != nullptr) {
+      if (current[i] != nullptr) { current[i] = current[i]->next; }
-        current[i] = current[i]->next;
-      }
     }
   }
 #ifdef HAVE_OPENMP
@@ -197,9 +193,7 @@ void print_combine(struct text_object *obj, char *p, int p_max_size) {
 void free_combine(struct text_object *obj) {
   auto *cd = static_cast<struct combine_data *>(obj->data.opaque);
 
-  if (cd == nullptr) {
+  if (cd == nullptr) { return; }
-    return;
-  }
   free(cd->left);
   free(cd->seperation);
   free(cd->right);

src/irc.cc

@@ -47,14 +47,12 @@ struct ctx {
   struct ll_text *messages;
 };
 
-void ev_connected(irc_session_t *session, const char *event, const char *origin,
+void ev_connected(irc_session_t *session, const char *, const char *,
-                  const char **params, unsigned int count) {
+                  const char **, unsigned int) {
   struct ctx *ctxptr = (struct ctx *)irc_get_ctx(session);
   if (irc_cmd_join(session, ctxptr->chan, nullptr) != 0) {
     NORM_ERR("irc: %s", irc_strerror(irc_errno(session)));
   }
-  if (event || origin || params || count) {
-  }  // fix gcc warnings
 }
 
 void addmessage(struct ctx *ctxptr, char *nick, const char *text) {
@@ -93,33 +91,29 @@ void addmessage(struct ctx *ctxptr, char *nick, const char *text) {
   }
 }
 
-void ev_talkinchan(irc_session_t *session, const char *event,
+void ev_talkinchan(irc_session_t *session, const char *, const char *origin,
-                   const char *origin, const char **params,
+                   const char **params, unsigned int) {
-                   unsigned int count) {
   char nickname[64];
   struct ctx *ctxptr = (struct ctx *)irc_get_ctx(session);
 
   irc_target_get_nick(origin, nickname, sizeof(nickname));
   addmessage(ctxptr, nickname, params[1]);
-  if (session || event || count) {
-  }  // fix gcc warnings
 }
 
-void ev_num(irc_session_t *session, unsigned int event, const char *origin,
+void ev_num(irc_session_t *session, unsigned int event, const char *,
-            const char **params, unsigned int count) {
+            const char **params, unsigned int) {
   char attachment[4] = "_00";
 
   if (event == 433) {  // nick in use
-    char *newnick = (char *)malloc(strlen(params[1]) + 4);
+    int len = strlen(params[1]) + 4;
+    char *newnick = (char *)malloc(len);
     strcpy(newnick, params[1]);
     attachment[1] += rand() % 10;
     attachment[2] += rand() % 10;
-    strcat(newnick, attachment);
+    strncat(newnick, attachment, len - 1);
     irc_cmd_nick(session, newnick);
     free(newnick);
   }
-  if (origin || count) {
-  }  // fix gcc warnings
 }
 
 #define IRCSYNTAX \
@@ -146,9 +140,7 @@ void *ircclient(void *ptr) {
   ircobj->session = irc_create_session(&callbacks);
   server = strtok(ircobj->arg, " ");
   ctxptr->chan = strtok(nullptr, " ");
-  if (!ctxptr->chan) {
+  if (!ctxptr->chan) { NORM_ERR("irc: %s", IRCSYNTAX); }
-    NORM_ERR("irc: %s", IRCSYNTAX);
-  }
   str_max_msg_lines = strtok(nullptr, " ");
   if (str_max_msg_lines) {
     ctxptr->max_msg_lines = strtol(str_max_msg_lines, nullptr, 10);
@@ -165,21 +157,15 @@ void *ircclient(void *ptr) {
   }
   int err = irc_connect(ircobj->session, server, port, IRCSERVERPASS, IRCNICK,
                         IRCUSER, IRCREAL);
-  if (err != 0) {
+  if (err != 0) { err = irc_errno(ircobj->session); }
-    err = irc_errno(ircobj->session);
-  }
 #ifdef BUILD_IPV6
   if (err == LIBIRC_ERR_RESOLV) {
     err = irc_connect6(ircobj->session, server, port, IRCSERVERPASS, IRCNICK,
                        IRCUSER, IRCREAL);
-    if (err != 0) {
+    if (err != 0) { err = irc_errno(ircobj->session); }
-      err = irc_errno(ircobj->session);
-    }
   }
 #endif /* BUILD_IPV6 */
-  if (err != 0) {
+  if (err != 0) { NORM_ERR("irc: %s", irc_strerror(err)); }
-    NORM_ERR("irc: %s", irc_strerror(err));
-  }
   if (irc_run(ircobj->session) != 0) {
     int ircerror = irc_errno(ircobj->session);
     if (irc_is_connected(ircobj->session)) {
@@ -221,12 +207,8 @@ void print_irc(struct text_object *obj, char *p, int p_max_size) {
     }
     curmsg = nextmsg;
   }
-  if (p[0] != 0) {
+  if (p[0] != 0) { p[strlen(p) - 1] = 0; }
-    p[strlen(p) - 1] = 0;
+  if (!ctxptr->max_msg_lines) { ctxptr->messages = nullptr; }
-  }
-  if (!ctxptr->max_msg_lines) {
-    ctxptr->messages = nullptr;
-  }
 }
 
 void free_irc(struct text_object *obj) {

src/linux.cc

@@ -1032,7 +1032,7 @@ static int open_sysfs_sensor(const char *dir, const char *dev, const char *type,
     if (*buf) {
       /* buf holds result from get_first_file_in_a_directory() above,
        * e.g. "hwmon0" -- append "/device" */
-      strcat(buf, "/device");
+      strncat(buf, "/device", 256);
     } else {
       /* dev holds device number N as a string,
        * e.g. "0", -- convert to "hwmon0/device" */
@@ -1760,7 +1760,7 @@ void get_battery_stuff(char *buffer, unsigned int n, const char *bat,
     char charging_state[64];
     char present[4];
 
-    strcpy(charging_state, "unknown");
+    strncpy(charging_state, "unknown", 64);
 
     while (!feof(sysfs_bat_fp[idx])) {
       char buf[256];
@@ -1768,9 +1768,9 @@ void get_battery_stuff(char *buffer, unsigned int n, const char *bat,
 
       /* let's just hope units are ok */
       if (strncmp(buf, "POWER_SUPPLY_PRESENT=1", 22) == 0)
-        strcpy(present, "yes");
+        strncpy(present, "yes", 4);
       else if (strncmp(buf, "POWER_SUPPLY_PRESENT=0", 22) == 0)
-        strcpy(present, "no");
+        strncpy(present, "no", 4);
       else if (strncmp(buf, "POWER_SUPPLY_STATUS=", 20) == 0)
         sscanf(buf, "POWER_SUPPLY_STATUS=%63s", charging_state);
       /* present_rate is not the same as the current flowing now but it
@@ -1863,9 +1863,9 @@ void get_battery_stuff(char *buffer, unsigned int n, const char *bat,
        * when the second one is empty and the first one
        * being charged. */
       if (remaining_capacity == 0)
-        strcpy(last_battery_str[idx], "empty");
+        strncpy(last_battery_str[idx], "empty", 64);
       else
-        strcpy(last_battery_str[idx], "charged");
+        strncpy(last_battery_str[idx], "charged", 64);
     }
     /* unknown, probably full / AC */
     else {
@@ -1907,7 +1907,7 @@ void get_battery_stuff(char *buffer, unsigned int n, const char *bat,
 
     fseek(acpi_bat_fp[idx], 0, SEEK_SET);
 
-    strcpy(charging_state, "unknown");
+    strncpy(charging_state, "unknown", 8);
 
     while (!feof(acpi_bat_fp[idx])) {
       char buf[256];

src/llua.cc

@@ -150,8 +150,8 @@ void llua_init() {
   lua_getfield(lua_L, -1, "cpath");
   old_path = strdup(lua_tostring(lua_L, -1));
   new_path = static_cast<char *>(malloc(strlen(old_path) + strlen(libs) + 1));
-  strcpy(new_path, libs);
+  strncpy(new_path, libs, strlen(libs));
-  strcat(new_path, old_path);
+  strncat(new_path, old_path, strlen(old_path));
   lua_pushstring(lua_L, new_path);
   lua_setfield(lua_L, -3, "cpath");
   lua_pop(lua_L, 2);

src/read_tcpip.cc

@@ -41,7 +41,7 @@
 #include "text_object.h"
 
 #ifndef SOCK_CLOEXEC
-# define SOCK_CLOEXEC O_CLOEXEC
+#define SOCK_CLOEXEC O_CLOEXEC
 #endif /* SOCK_CLOEXEC */
 
 struct read_tcpip_data {
@@ -62,7 +62,7 @@ void parse_read_tcpip_arg(struct text_object *obj, const char *arg,
   sscanf(arg + strlen(rtd->host), "%u", &(rtd->port));
   if (rtd->port == 0) {
     rtd->port = atoi(rtd->host);
-    strcpy(rtd->host, "localhost");
+    strncpy(rtd->host, "localhost", 10);
   }
   if (rtd->port < 1 || rtd->port > 65535)
     CRIT_ERR(obj, free_at_crash,
@@ -162,9 +162,7 @@ void print_read_tcpip(struct text_object *obj, char *p, int p_max_size,
   struct addrinfo *airesult, *rp;
   char portbuf[8];
 
-  if (rtd == nullptr) {
+  if (rtd == nullptr) { return; }
-    return;
-  }
 
   memset(&hints, 0, sizeof(struct addrinfo));
   hints.ai_family = AF_UNSPEC;
@@ -179,12 +177,8 @@ void print_read_tcpip(struct text_object *obj, char *p, int p_max_size,
   }
   for (rp = airesult; rp != nullptr; rp = rp->ai_next) {
     sock = socket(rp->ai_family, rp->ai_socktype, rp->ai_protocol);
-    if (sock == -1) {
+    if (sock == -1) { continue; }
-      continue;
+    if (connect(sock, rp->ai_addr, rp->ai_addrlen) != -1) { break; }
-    }
-    if (connect(sock, rp->ai_addr, rp->ai_addrlen) != -1) {
-      break;
-    }
     close(sock);
     return;
   }
@@ -231,9 +225,7 @@ void print_read_udp(struct text_object *obj, char *p, int p_max_size) {
 void free_read_tcpip(struct text_object *obj) {
   auto *rtd = static_cast<struct read_tcpip_data *>(obj->data.opaque);
 
-  if (rtd == nullptr) {
+  if (rtd == nullptr) { return; }
-    return;
-  }
 
   free_and_zero(rtd->host);
   free_and_zero(obj->data.opaque);
@@ -242,9 +234,7 @@ void free_read_tcpip(struct text_object *obj) {
 void free_tcp_ping(struct text_object *obj) {
   auto *addr = static_cast<struct sockaddr_in *>(obj->data.opaque);
 
-  if (addr == nullptr) {
+  if (addr == nullptr) { return; }
-    return;
-  }
 
   free_and_zero(obj->data.opaque);
 }

src/scroll.cc

@@ -26,13 +26,13 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  *
  */
+#include <vector>
 #include "conky.h"
 #include "core.h"
 #include "logging.h"
 #include "specials.h"
 #include "text_object.h"
 #include "x11.h"
-#include <vector>
 
 /**
  * Length of a character in bytes.
@@ -44,17 +44,11 @@ inline int scroll_character_length(char c) {
     auto uc = static_cast<unsigned char>(c);
     int len = 0;
 
-    if (c == -1) {
+    if (c == -1) { return 1; }
-      return 1;
-    }
 
-    if ((uc & 0x80) == 0) {
+    if ((uc & 0x80) == 0) { return 1; }
-      return 1;
-    }
 
-    while (len < 7 && (uc & (0x80 >> len)) != 0) {
+    while (len < 7 && (uc & (0x80 >> len)) != 0) { ++len; }
-      ++len;
-    }
 
     return len;
   }
@@ -69,12 +63,8 @@ inline int scroll_character_length(char c) {
  */
 inline bool scroll_check_skip_byte(char c) {
 #ifdef BUILD_X11
-  if (utf8_mode.get(*state)) {
   // Check if byte matches UTF-8 continuation byte pattern (0b10xxxxxx)
-    if ((c & 0xC0) == 0x80) {
+  if (utf8_mode.get(*state) && (c & 0xC0) == 0x80) { return true; }
-      return true;
-    }
-  }
 #endif
 
   return SPECIAL_CHAR == c;
@@ -120,23 +110,17 @@ static void scroll_scroll_left(struct scroll_data *sd,
     sd->start += scroll_character_length(buf[sd->start]);
   }
 
-  if (buf[sd->start] == 0 || sd->start > strlen(buf.data())) {
+  if (buf[sd->start] == 0 || sd->start > strlen(buf.data())) { sd->start = 0; }
-    sd->start = 0;
-  }
 }
 
 static void scroll_scroll_right(struct scroll_data *sd,
                                 const std::vector<char> &buf,
                                 unsigned int amount) {
   for (int i = 0; i < amount; ++i) {
-    if (sd->start <= 0) {
+    if (sd->start <= 0) { sd->start = static_cast<int>(strlen(&(buf[0]))); }
-      sd->start = static_cast<int>(strlen(&(buf[0])));
-    }
 
     while (--(sd->start) >= 0) {
-      if (!scroll_check_skip_byte(buf[sd->start])) {
+      if (!scroll_check_skip_byte(buf[sd->start])) { break; }
-        break;
-      }
     }
   }
 }
@@ -202,7 +186,7 @@ void parse_scroll_arg(struct text_object *obj, const char *arg,
     sd->text[0] = 0;
   }
 
-  strcat(sd->text, arg + n1);
+  strncat(sd->text, arg + n1, strlen(arg + n1));
   sd->start = sd->direction == SCROLL_WAIT ? strlen(sd->text) : 0;
   obj->sub =
       static_cast<struct text_object *>(malloc(sizeof(struct text_object)));
@@ -223,9 +207,7 @@ void print_scroll(struct text_object *obj, char *p, int p_max_size) {
   char *pwithcolors;
   std::vector<char> buf(max_user_text.get(*state), static_cast<char>(0));
 
-  if (sd == nullptr) {
+  if (sd == nullptr) { return; }
-    return;
-  }
 
   generate_text_internal(&(buf[0]), max_user_text.get(*state), *obj->sub);
   for (j = 0; buf[j] != 0; j++) {
@@ -247,20 +229,14 @@ void print_scroll(struct text_object *obj, char *p, int p_max_size) {
   }
   // if length of text changed to shorter so the (sd->start) is already
   // outside of actual text then reset (sd->start)
-  if (sd->start >= strlen(&(buf[0]))) {
+  if (sd->start >= strlen(&(buf[0]))) { sd->start = 0; }
-    sd->start = 0;
-  }
   // make sure a colorchange at the front is not part of the string we are going
   // to show
-  while (buf[sd->start] == SPECIAL_CHAR) {
+  while (buf[sd->start] == SPECIAL_CHAR) { sd->start++; }
-    sd->start++;
-  }
   // place all chars that should be visible in p, including colorchanges
   for (j = 0, visiblechars = 0; visiblechars < sd->show;) {
     char c = p[j] = buf[sd->start + j];
-    if (0 == c) {
+    if (0 == c) { break; }
-      break;
-    }
 
     ++j;
 
@@ -277,24 +253,18 @@ void print_scroll(struct text_object *obj, char *p, int p_max_size) {
       ++visiblechars;
     }
   }
-  for (; visiblechars < sd->show; j++, visiblechars++) {
+  for (; visiblechars < sd->show; j++, visiblechars++) { p[j] = ' '; }
-    p[j] = ' ';
-  }
   p[j] = 0;
   // count colorchanges in front of the visible part and place that many
   // colorchanges in front of the visible part
   for (j = 0; j < static_cast<unsigned>(sd->start); j++) {
-    if (buf[j] == SPECIAL_CHAR) {
+    if (buf[j] == SPECIAL_CHAR) { frontcolorchanges++; }
-      frontcolorchanges++;
-    }
-  }
-  pwithcolors = static_cast<char *>(
-      malloc(strlen(p) + 4 + colorchanges - visibcolorchanges));
-  for (j = 0; j < frontcolorchanges; j++) {
-    pwithcolors[j] = SPECIAL_CHAR;
   }
+  int pwithcolors_len = strlen(p) + 4 + colorchanges - visibcolorchanges;
+  pwithcolors = static_cast<char *>(malloc(pwithcolors_len));
+  for (j = 0; j < frontcolorchanges; j++) { pwithcolors[j] = SPECIAL_CHAR; }
   pwithcolors[j] = 0;
-  strcat(pwithcolors, p);
+  strncat(pwithcolors, p, pwithcolors_len);
   strend = strlen(pwithcolors);
   // and place the colorchanges not in front or in the visible part behind the
   // visible part
@@ -302,7 +272,7 @@ void print_scroll(struct text_object *obj, char *p, int p_max_size) {
     pwithcolors[strend + j] = SPECIAL_CHAR;
   }
   pwithcolors[strend + j] = 0;
-  strcpy(p, pwithcolors);
+  strncpy(p, pwithcolors, p_max_size);
   free(pwithcolors);
   // scroll
   if (sd->direction == SCROLL_LEFT) {
@@ -342,9 +312,7 @@ void print_scroll(struct text_object *obj, char *p, int p_max_size) {
 void free_scroll(struct text_object *obj) {
   auto *sd = static_cast<struct scroll_data *>(obj->data.opaque);
 
-  if (sd == nullptr) {
+  if (sd == nullptr) { return; }
-    return;
-  }
 
   free_and_zero(sd->text);
   free_text_objects(obj->sub);

src/template.cc

@@ -59,9 +59,7 @@ static char *backslash_escape(const char *src, char **templates,
   while (*p != 0) {
     switch (*p) {
       case '\\':
-        if (*(p + 1) == 0) {
+        if (*(p + 1) == 0) { break; }
-          break;
-        }
         if (*(p + 1) == '\\') {
           src_dup[dup_idx++] = '\\';
           p++;
@@ -131,9 +129,7 @@ static char *handle_template(const char *tmpl, const char *args) {
       while ((*p != 0) && (*p == ' ' && (p == args_dup || *(p - 1) != '\\'))) {
         p++;
       }
-      if (p > args_dup && *(p - 1) == '\\') {
+      if (p > args_dup && *(p - 1) == '\\') { p--; }
-        p--;
-      }
       p_old = p;
       while ((*p != 0) && (*p != ' ' || (p > args_dup && *(p - 1) == '\\'))) {
         p++;
@@ -157,9 +153,7 @@ static char *handle_template(const char *tmpl, const char *args) {
                                argsp, argcnt);
   DBGP("substituted %s, output is '%s'", tmpl, eval_text);
   free(args_dup);
-  for (i = 0; i < argcnt; i++) {
+  for (i = 0; i < argcnt; i++) { free(argsp[i]); }
-    free(argsp[i]);
-  }
   free(argsp);
   return eval_text;
 }
@@ -176,13 +170,9 @@ char *find_and_replace_templates(const char *inbuf) {
 
   p = indup = strdup(inbuf);
   while (*p != 0) {
-    while ((*p != 0) && *p != '$') {
+    while ((*p != 0) && *p != '$') { *(o++) = *(p++); }
-      *(o++) = *(p++);
-    }
 
-    if ((*p) == 0) {
+    if ((*p) == 0) { break; }
-      break;
-    }
 
     if ((static_cast<int>(strncmp(p, "$template", strlen("$template")) != 0) !=
          0) &&
@@ -194,9 +184,7 @@ char *find_and_replace_templates(const char *inbuf) {
     if (*(p + 1) == '{') {
       p += 2;
       templ = p;
-      while ((*p != 0) && (isspace(*p) == 0) && *p != '{' && *p != '}') {
+      while ((*p != 0) && (isspace(*p) == 0) && *p != '{' && *p != '}') { p++; }
-        p++;
-      }
       if (*p == '}') {
         args = nullptr;
       } else {
@@ -223,17 +211,16 @@ char *find_and_replace_templates(const char *inbuf) {
     } else {
       templ = p + 1;
       p += strlen("$template");
-      while ((*p != 0) && (isdigit(*p) != 0)) {
+      while ((*p != 0) && (isdigit(*p) != 0)) { p++; }
-        p++;
-      }
       args = nullptr;
     }
     tmpl_out = handle_template(templ, args);
     if (tmpl_out != nullptr) {
-      outlen += strlen(tmpl_out);
+      int len = strlen(tmpl_out);
+      outlen += len;
       *o = '\0';
       outbuf = static_cast<char *>(realloc(outbuf, outlen * sizeof(char)));
-      strcat(outbuf, tmpl_out);
+      strncat(outbuf, tmpl_out, len);
       free(tmpl_out);
       o = outbuf + strlen(outbuf);
     } else {
@@ -249,11 +236,7 @@ char *find_and_replace_templates(const char *inbuf) {
 
 /* check text for any template object references */
 int text_contains_templates(const char *text) {
-  if (strcasestr(text, "${template") != nullptr) {
+  if (strcasestr(text, "${template") != nullptr) { return 1; }
-    return 1;
+  if (strcasestr(text, "$template") != nullptr) { return 1; }
-  }
-  if (strcasestr(text, "$template") != nullptr) {
-    return 1;
-  }
   return 0;
 }

src/timeinfo.cc

@@ -100,9 +100,7 @@ void print_tztime(struct text_object *obj, char *p, int p_max_size) {
   struct tm *tm;
   auto *ts = static_cast<tztime_s *>(obj->data.opaque);
 
-  if (ts == nullptr) {
+  if (ts == nullptr) { return; }
-    return;
-  }
 
   if (ts->tz != nullptr) {
     oldTZ = getenv("TZ");
@@ -128,9 +126,7 @@ void free_time(struct text_object *obj) { free_and_zero(obj->data.opaque); }
 void free_tztime(struct text_object *obj) {
   auto *ts = static_cast<tztime_s *>(obj->data.opaque);
 
-  if (ts == nullptr) {
+  if (ts == nullptr) { return; }
-    return;
-  }
 
   free_and_zero(ts->tz);
   free_and_zero(ts->fmt);
@@ -171,9 +167,7 @@ static void do_format_time(struct text_object *obj, char *p,
   errno = 0;
   seconds = strtod(obj->data.s, &currentchar);
   if (errno == 0 && obj->data.s != currentchar) {
-    while (*currentchar != 0 && *currentchar != '"') {
+    while (*currentchar != 0 && *currentchar != '"') { currentchar++; }
-      currentchar++;
-    }
     if (*currentchar != 0) {
       currentchar++;
       minutes = seconds / 60;
@@ -205,18 +199,10 @@ static void do_format_time(struct text_object *obj, char *p,
           }
         }
       }
-      if (show_weeks == 0) {
+      if (show_weeks == 0) { days += weeks * 7; }
-        days += weeks * 7;
+      if (show_days == 0) { hours += days * 24; }
-      }
+      if (show_hours == 0) { minutes += hours * 60; }
-      if (show_days == 0) {
+      if (show_minutes == 0) { seconds += minutes * 60; }
-        hours += days * 24;
-      }
-      if (show_hours == 0) {
-        minutes += hours * 60;
-      }
-      if (show_minutes == 0) {
-        seconds += minutes * 60;
-      }
       hidestring = 0;
       while (output_length < p_max_size - 1) {
         if (*currentchar != 0 && *currentchar != '"') {
@@ -275,30 +261,20 @@ static void do_format_time(struct text_object *obj, char *p,
               if (*(temp - 1) == '\\') {
                 switch (*temp) {
                   case 'w':
-                    if (weeks == 0) {
+                    if (weeks == 0) { hidestring = 1; }
-                      hidestring = 1;
-                    }
                     break;
                   case 'd':
-                    if (days == 0) {
+                    if (days == 0) { hidestring = 1; }
-                      hidestring = 1;
-                    }
                     break;
                   case 'h':
-                    if (hours == 0) {
+                    if (hours == 0) { hidestring = 1; }
-                      hidestring = 1;
-                    }
                     break;
                   case 'm':
-                    if (minutes == 0) {
+                    if (minutes == 0) { hidestring = 1; }
-                      hidestring = 1;
-                    }
                     break;
                   case 's':
                   case 'S':
-                    if (seconds == 0) {
+                    if (seconds == 0) { hidestring = 1; }
-                      hidestring = 1;
-                    }
                     break;
                 }
               }
@@ -312,7 +288,8 @@ static void do_format_time(struct text_object *obj, char *p,
           }
           if (temp != nullptr) {
             if (output_length + strlen(temp) < p_max_size - 1) {
-              strcpy(p + output_length, temp);
+              strncpy(p + output_length, temp,
+                      p_max_size - output_length + strlen(temp));
               output_length += strlen(temp);
             } else {
               NORM_ERR("The format string for $format_time is too long");

src/users.cc

@@ -93,7 +93,7 @@ static void tty_user_time(char *ptr, char *tty) {
   struct utmp *usr, line;
 
   setutent();
-  strcpy(line.ut_line, tty);
+  strncpy(line.ut_line, tty, UT_LINESIZE);
   usr = getutline(&line);
   if (usr == nullptr) { return; }
 

src/weather.cc

@@ -22,7 +22,6 @@
  *
  */
 
-#include "weather.h"
 #include <ctype.h>
 #include <time.h>
 #include <array>
@@ -35,6 +34,7 @@
 #include "logging.h"
 #include "temphelper.h"
 #include "text_object.h"
+#include "weather.h"
 #ifdef BUILD_WEATHER_XOAP
 #include <libxml/parser.h>
 #include <libxml/xpath.h>
@@ -842,22 +842,29 @@ static int process_weather_uri(char *uri, char *locID, int dayf UNUSED_ATTR) {
   }
 
   /* Construct complete uri */
+  int len_remaining = 128;
 #ifdef BUILD_WEATHER_XOAP
   if (strstr(uri, "xoap.weather.com")) {
     if ((dayf == 0) && (xoap_cc.length() != 0)) {
-      strcat(uri, locID);
+      strncat(uri, locID, len_remaining);
-      strcat(uri, xoap_cc.c_str());
+      len_remaining -= strlen(locID);
+      strncat(uri, xoap_cc.c_str(), len_remaining);
+      len_remaining -= strlen(xoap_cc.c_str());
     } else if ((dayf == 1) && (xoap_df.length() != 0)) {
-      strcat(uri, locID);
+      strncat(uri, locID, len_remaining);
-      strcat(uri, xoap_df.c_str());
+      len_remaining -= strlen(locID);
+      strncat(uri, xoap_df.c_str(), len_remaining);
+      len_remaining -= strlen(xoap_df.c_str());
     } else {
       return 0;
     }
   } else
 #endif /* BUILD_WEATHER_XOAP */
       if (strstr(uri, "tgftp.nws.noaa.gov")) {
-    strcat(uri, locID);
+    strncat(uri, locID, len_remaining);
-    strcat(uri, ".TXT");
+    len_remaining -= strlen(locID);
+    strncat(uri, ".TXT", len_remaining);
+    len_remaining -= 5;
   } else if (!strstr(uri, "localhost") && !strstr(uri, "127.0.0.1")) {
     return -1;
   }
@@ -921,14 +928,10 @@ void scan_weather_forecast_arg(struct text_object *obj, const char *arg,
   }
 
   /* Limit the day between 0 (today) and FORECAST_DAYS */
-  if (wfd->day >= FORECAST_DAYS) {
+  if (wfd->day >= FORECAST_DAYS) { wfd->day = FORECAST_DAYS - 1; }
-    wfd->day = FORECAST_DAYS - 1;
-  }
 
   /* Limit the data retrieval interval to 3 hours and an half */
-  if (interval < 210) {
+  if (interval < 210) { interval = 210; }
-    interval = 210;
-  }
 
   /* Convert to seconds */
   wfd->interval = interval * 60;
@@ -980,9 +983,7 @@ void scan_weather_arg(struct text_object *obj, const char *arg,
   }
 
   /* Limit the data retrieval interval to half hour min */
-  if (interval < 30) {
+  if (interval < 30) { interval = 30; }
-    interval = 30;
-  }
 
   /* Convert to seconds */
   wd->interval = interval * 60;