* Bug #15213, #18635: The use of the insecure m_scratch() and

[mmh] / uip / annosbr.c

diff --git a/uip/annosbr.c b/uip/annosbr.c
index 337a01b..7f1bdde 100644 (file)
--- a/uip/annosbr.c
+++ b/uip/annosbr.c
@@ -120,8 +120,7 @@ annolist(char *file, char *comp, char *text, int number)
            }
 
            if (++n >= field_size - 1) {
-               if ((field = (char *)realloc((void *)field, field_size += 256)) == (char *)0)
-                   adios(NULL, "can't grow field buffer.");
+               field = (char *) mh_xrealloc((void *)field, field_size += 256);
                
                cp = field + n - 1;
            }
@@ -180,20 +179,15 @@ annosbr (int fd, char *file, char *comp, char *text, int inplace, int datesw, in
     FILE       *tmp;
     int                c;              /* current character */
     int                count;          /* header field (annotation) counter */
-    char       *field;         /* buffer for header field */
-    int                field_size;     /* size of field buffer */
-    FILE       *fp;            /* file pointer made from locked file descriptor */
+    char       *field = NULL;  /* buffer for header field */
+    int                field_size = 0; /* size of field buffer */
+    FILE       *fp = NULL;     /* file pointer made from locked file descriptor */
     int                length;         /* length of field name */
     int                n;              /* number of bytes written */
 
     mode = fstat (fd, &st) != NOTOK ? (st.st_mode & 0777) : m_gmprot ();
 
-    strncpy (tmpfil, m_scratch (file, "annotate"), sizeof(tmpfil));
-
-    if ((tmp = fopen (tmpfil, "w")) == NULL) {
-       admonish (tmpfil, "unable to create");
-       return 1;
-    }
+    strncpy (tmpfil, m_mktemp2(file, "annotate", NULL, &tmp), sizeof(tmpfil));
     chmod (tmpfil, mode);
 
     /*
@@ -262,8 +256,7 @@ annosbr (int fd, char *file, char *comp, char *text, int inplace, int datesw, in
                }
 
                if (++n >= field_size - 1) {
-                   if ((field = (char *)realloc((void *)field, field_size *= 2)) == (char *)0)
-                       adios(NULL, "can't grow field buffer.");
+                   field = (char *) mh_xrealloc((void *)field, field_size *= 2);
                
                    cp = field + n - 1;
                }
@@ -383,7 +376,7 @@ annosbr (int fd, char *file, char *comp, char *text, int inplace, int datesw, in
                while (*cp && *cp++ != '\n')
                    continue;
                if (cp - sp)
-                   fprintf (tmp, "%s: %*.*s", comp, cp - sp, cp - sp, sp);
+                   fprintf (tmp, "%s: %*.*s", comp, (int)(cp - sp), (int)(cp - sp), sp);
            } while (*cp);
            if (cp[-1] != '\n' && cp != text)
                putc ('\n', tmp);