asprintf and snprintf support

commands/ls.c

@@ -86,7 +86,7 @@ grub_ls_list_files (char *dirname, int longlist, int all, int human)
   int print_files_long (const char *filename,
 			const struct grub_dirhook_info *info)
     {
-      char pathname[grub_strlen (dirname) + grub_strlen (filename) + 1];
+      char *pathname;
 
       if ((! all) && (filename[0] == '.'))
 	return 0;
@@ -96,9 +96,12 @@ grub_ls_list_files (char *dirname, int longlist, int all, int human)
 	  grub_file_t file;
 
 	  if (dirname[grub_strlen (dirname) - 1] == '/')
-	    grub_sprintf (pathname, "%s%s", dirname, filename);
+	    pathname = grub_asprintf ("%s%s", dirname, filename);
 	  else
-	    grub_sprintf (pathname, "%s/%s", dirname, filename);
+	    pathname = grub_asprintf ("%s/%s", dirname, filename);
+
+	  if (!pathname)
+	    return 1;
 
 	  /* XXX: For ext2fs symlinks are detected as files while they
 	     should be reported as directories.  */
@@ -130,8 +133,9 @@ grub_ls_list_files (char *dirname, int longlist, int all, int human)
 		  grub_uint32_t whole, fraction;
 
 		  whole = grub_divmod64 (fsize, 100, &fraction);
-		  grub_sprintf (buf, "%u.%02u%c", whole, fraction,
+		  grub_snprintf (buf, sizeof (buf),
-				grub_human_sizes[units]);
+				 "%u.%02u%c", whole, fraction,
+				 grub_human_sizes[units]);
 		  grub_printf ("%-12s", buf);
 		}
 	      else

commands/memrw.c

@@ -61,7 +61,7 @@ grub_cmd_read (grub_extcmd_t cmd, int argc, char **argv)
 
   if (cmd->state[0].set)
     {
-      grub_sprintf (buf, "%x", value);
+      grub_snprintf (buf, sizeof (buf), "%x", value);
       grub_env_set (cmd->state[0].arg, buf);
     }
   else

commands/parttool.c

@@ -182,12 +182,11 @@ grub_cmd_parttool (grub_command_t cmd __attribute__ ((unused)),
       {
 	char *filename;
 
-	filename = grub_malloc (grub_strlen (prefix) + sizeof ("/parttool.lst"));
+	filename = grub_asprintf ("%s/parttool.lst", prefix);
 	if (filename)
 	  {
 	    grub_file_t file;
 
-	    grub_sprintf (filename, "%s/parttool.lst", prefix);
 	    file = grub_file_open (filename);
 	    if (file)
 	      {

commands/search.c

@@ -33,7 +33,6 @@ void
 FUNC_NAME (const char *key, const char *var, int no_floppy)
 {
   int count = 0;
-  char *buf = NULL;
   grub_fs_autoload_hook_t saved_autoload;
 
   auto int iterate_device (const char *name);
@@ -48,24 +47,20 @@ FUNC_NAME (const char *key, const char *var, int no_floppy)
 
 #ifdef DO_SEARCH_FILE
       {
-	grub_size_t len;
+	char *buf;
-	char *p;
 	grub_file_t file;
 
-	len = grub_strlen (name) + 2 + grub_strlen (key) + 1;
+	buf = grub_asprintf ("(%s)%s", name, key);
-	p = grub_realloc (buf, len);
+	if (! buf)
-	if (! p)
 	  return 1;
 
-	buf = p;
-	grub_sprintf (buf, "(%s)%s", name, key);
-
 	file = grub_file_open (buf);
 	if (file)
 	  {
 	    found = 1;
 	    grub_file_close (file);
 	  }
+	grub_free (buf);
       }
 #else
       {
@@ -135,8 +130,6 @@ FUNC_NAME (const char *key, const char *var, int no_floppy)
   else
     grub_device_iterate (iterate_device);
 
-  grub_free (buf);
-
   if (grub_errno == GRUB_ERR_NONE && count == 0)
     grub_error (GRUB_ERR_FILE_NOT_FOUND, "no such device: %s", key);
 }

commands/xnu_uuid.c

@@ -349,18 +349,18 @@ grub_cmd_xnu_uuid (grub_command_t cmd __attribute__ ((unused)),
   grub_memcpy (hashme.prefix, hash_prefix, sizeof (hashme.prefix));
 
   md5 ((char *) &hashme, sizeof (hashme), (char *) xnu_uuid);
-  grub_sprintf (uuid_string,
+  grub_snprintf (uuid_string, sizeof (uuid_string),
-		"%02x%02x%02x%02x-%02x%02x-%02x%02x-%02x%02x-%02x%02x%02x%02x%02x%02x",
+		 "%02x%02x%02x%02x-%02x%02x-%02x%02x-%02x%02x-%02x%02x%02x%02x%02x%02x",
-		(unsigned int) xnu_uuid[0], (unsigned int) xnu_uuid[1],
+		 (unsigned int) xnu_uuid[0], (unsigned int) xnu_uuid[1],
-		(unsigned int) xnu_uuid[2], (unsigned int) xnu_uuid[3],
+		 (unsigned int) xnu_uuid[2], (unsigned int) xnu_uuid[3],
-		(unsigned int) xnu_uuid[4], (unsigned int) xnu_uuid[5],
+		 (unsigned int) xnu_uuid[4], (unsigned int) xnu_uuid[5],
-		(unsigned int) ((xnu_uuid[6] & 0xf) | 0x30),
+		 (unsigned int) ((xnu_uuid[6] & 0xf) | 0x30),
-		(unsigned int) xnu_uuid[7],
+		 (unsigned int) xnu_uuid[7],
-		(unsigned int) ((xnu_uuid[8] & 0x3f) | 0x80),
+		 (unsigned int) ((xnu_uuid[8] & 0x3f) | 0x80),
-		(unsigned int) xnu_uuid[9],
+		 (unsigned int) xnu_uuid[9],
-		(unsigned int) xnu_uuid[10], (unsigned int) xnu_uuid[11],
+		 (unsigned int) xnu_uuid[10], (unsigned int) xnu_uuid[11],
-		(unsigned int) xnu_uuid[12], (unsigned int) xnu_uuid[13],
+		 (unsigned int) xnu_uuid[12], (unsigned int) xnu_uuid[13],
-		(unsigned int) xnu_uuid[14], (unsigned int) xnu_uuid[15]);
+		 (unsigned int) xnu_uuid[14], (unsigned int) xnu_uuid[15]);
   for (ptr = uuid_string; *ptr; ptr++)
     *ptr = grub_toupper (*ptr);
   if (argc == 1)

disk/ata.c

@@ -648,12 +648,14 @@ grub_ata_iterate (int (*hook) (const char *name))
 
   for (dev = grub_ata_devices; dev; dev = dev->next)
     {
-      char devname[5];
+      char devname[10];
-      grub_sprintf (devname, "ata%d", dev->port * 2 + dev->device);
 
       if (dev->atapi)
 	continue;
 
+      grub_snprintf (devname, sizeof (devname), 
+		     "ata%d", dev->port * 2 + dev->device);
+
       if (hook (devname))
 	return 1;
     }
@@ -668,8 +670,9 @@ grub_ata_open (const char *name, grub_disk_t disk)
 
   for (dev = grub_ata_devices; dev; dev = dev->next)
     {
-      char devname[5];
+      char devname[10];
-      grub_sprintf (devname, "ata%d", dev->port * 2 + dev->device);
+      grub_snprintf (devname, sizeof (devname),
+		     "ata%d", dev->port * 2 + dev->device);
       if (grub_strcmp (name, devname) == 0)
 	break;
     }
@@ -735,8 +738,9 @@ grub_atapi_iterate (int (*hook) (const char *name, int luns))
 
   for (dev = grub_ata_devices; dev; dev = dev->next)
     {
-      char devname[7];
+      char devname[10];
-      grub_sprintf (devname, "ata%d", dev->port * 2 + dev->device);
+      grub_snprintf (devname, sizeof (devname),
+		     "ata%d", dev->port * 2 + dev->device);
 
       if (! dev->atapi)
 	continue;
@@ -808,8 +812,9 @@ grub_atapi_open (const char *name, struct grub_scsi *scsi)
 
   for (dev = grub_ata_devices; dev; dev = dev->next)
     {
-      char devname[7];
+      char devname[10];
-      grub_sprintf (devname, "ata%d", dev->port * 2 + dev->device);
+      grub_snprintf (devname, sizeof (devname),
+		     "ata%d", dev->port * 2 + dev->device);
 
       if (!grub_strcmp (devname, name))
 	{

disk/efi/efidisk.c

@@ -440,7 +440,7 @@ grub_efidisk_iterate (int (*hook) (const char *name))
 
   for (d = fd_devices, count = 0; d; d = d->next, count++)
     {
-      grub_sprintf (buf, "fd%d", count);
+      grub_snprintf (buf, sizeof (buf), "fd%d", count);
       grub_dprintf ("efidisk", "iterating %s\n", buf);
       if (hook (buf))
 	return 1;
@@ -448,7 +448,7 @@ grub_efidisk_iterate (int (*hook) (const char *name))
 
   for (d = hd_devices, count = 0; d; d = d->next, count++)
     {
-      grub_sprintf (buf, "hd%d", count);
+      grub_snprintf (buf, sizeof (buf), "hd%d", count);
       grub_dprintf ("efidisk", "iterating %s\n", buf);
       if (hook (buf))
 	return 1;
@@ -456,7 +456,7 @@ grub_efidisk_iterate (int (*hook) (const char *name))
 
   for (d = cd_devices, count = 0; d; d = d->next, count++)
     {
-      grub_sprintf (buf, "cd%d", count);
+      grub_snprintf (buf, sizeof (buf), "cd%d", count);
       grub_dprintf ("efidisk", "iterating %s\n", buf);
       if (hook (buf))
 	return 1;
@@ -805,18 +805,10 @@ grub_efidisk_get_device_name (grub_efi_handle_t *handle)
 	  return 0;
 	}
 
-      device_name = grub_malloc (grub_strlen (parent->name) + 1
+      device_name = grub_asprintf ("%s,%s", parent->name, partition_name);
-				 + grub_strlen (partition_name) + 1);
-      if (! device_name)
-	{
-	  grub_free (partition_name);
-	  grub_disk_close (parent);
-	  return 0;
-	}
-
-      grub_sprintf (device_name, "%s,%s", parent->name, partition_name);
       grub_free (partition_name);
       grub_disk_close (parent);
+
       return device_name;
     }
   else

disk/i386/pc/biosdisk.c

@@ -56,7 +56,8 @@ grub_biosdisk_call_hook (int (*hook) (const char *name), int drive)
 {
   char name[10];
 
-    grub_sprintf (name, (drive & 0x80) ? "hd%d" : "fd%d", drive & (~0x80));
+  grub_snprintf (name, sizeof (name),
+		 (drive & 0x80) ? "hd%d" : "fd%d", drive & (~0x80));
   return hook (name);
 }
 

disk/raid.c

@@ -556,7 +556,7 @@ insert_array (grub_disk_t disk, struct grub_raid_array *new_array,
             }
         }
 
-      array->name = grub_malloc (13);
+      array->name = grub_asprintf ("md%d", array->number);
       if (! array->name)
         {
           grub_free (array->uuid);
@@ -565,8 +565,6 @@ insert_array (grub_disk_t disk, struct grub_raid_array *new_array,
           return grub_errno;
         }
 
-      grub_sprintf (array->name, "md%d", array->number);
-
       grub_dprintf ("raid", "Found array %s (%s)\n", array->name,
                     scanner_name);
 

disk/scsi.c

@@ -197,7 +197,6 @@ grub_scsi_iterate (int (*hook) (const char *name))
 
   int scsi_iterate (const char *name, int luns)
     {
-      char sname[40];
       int i;
 
       /* In case of a single LUN, just return `usbX'.  */
@@ -208,9 +207,13 @@ grub_scsi_iterate (int (*hook) (const char *name))
 	 distinguish it.  */
       for (i = 0; i < luns; i++)
 	{
-	  grub_sprintf (sname, "%s%c", name, 'a' + i);
+	  char *sname;
+	  sname = grub_asprintf ("%s%c", name, 'a' + i);
+	  if (!sname)
+	    return 1;
 	  if (hook (sname))
 	    return 1;
+	  grub_free (sname);
 	}
       return 0;
     }

disk/usbms.c

@@ -200,11 +200,15 @@ grub_usbms_iterate (int (*hook) (const char *name, int luns))
 
   for (p = grub_usbms_dev_list; p; p = p->next)
     {
-      char devname[20];
+      char *devname;
-      grub_sprintf (devname, "usb%d", cnt);
+      devname = grub_asprintf ("usb%d", cnt);
 
       if (hook (devname, p->luns))
-	return 1;
+	{
+	  grub_free (devname);
+	  return 1;
+	}
+      grub_free (devname);
       cnt++;
     }
 

efiemu/main.c

@@ -255,12 +255,11 @@ grub_efiemu_autocore (void)
 
   suffix = grub_efiemu_get_default_core_name ();
 
-  filename = grub_malloc (grub_strlen (prefix) + grub_strlen (suffix) + 2);
+  filename = grub_asprintf ("%s/%s", prefix, suffix);
   if (! filename)
     return grub_error (GRUB_ERR_OUT_OF_MEMORY,
 		       "couldn't allocate temporary space");
 
-  grub_sprintf (filename, "%s/%s", prefix, suffix);
 
   err = grub_efiemu_load_file (filename);
   grub_free (filename);

fs/ext2.c

@@ -875,12 +875,15 @@ grub_ext2_uuid (grub_device_t device, char **uuid)
   data = grub_ext2_mount (disk);
   if (data)
     {
-      *uuid = grub_malloc (40 + sizeof ('\0'));
+      *uuid = grub_asprintf ("%04x%04x-%04x-%04x-%04x-%04x%04x%04x",
-      grub_sprintf (*uuid, "%04x%04x-%04x-%04x-%04x-%04x%04x%04x",
+			     grub_be_to_cpu16 (data->sblock.uuid[0]),
-		    grub_be_to_cpu16 (data->sblock.uuid[0]), grub_be_to_cpu16 (data->sblock.uuid[1]),
+			     grub_be_to_cpu16 (data->sblock.uuid[1]),
-		    grub_be_to_cpu16 (data->sblock.uuid[2]), grub_be_to_cpu16 (data->sblock.uuid[3]),
+			     grub_be_to_cpu16 (data->sblock.uuid[2]),
-		    grub_be_to_cpu16 (data->sblock.uuid[4]), grub_be_to_cpu16 (data->sblock.uuid[5]),
+			     grub_be_to_cpu16 (data->sblock.uuid[3]),
-		    grub_be_to_cpu16 (data->sblock.uuid[6]), grub_be_to_cpu16 (data->sblock.uuid[7]));
+			     grub_be_to_cpu16 (data->sblock.uuid[4]),
+			     grub_be_to_cpu16 (data->sblock.uuid[5]),
+			     grub_be_to_cpu16 (data->sblock.uuid[6]),
+			     grub_be_to_cpu16 (data->sblock.uuid[7]));
     }
   else
     *uuid = NULL;

fs/fat.c

@@ -833,9 +833,9 @@ grub_fat_uuid (grub_device_t device, char **uuid)
   data = grub_fat_mount (disk);
   if (data)
     {
-      *uuid = grub_malloc (sizeof ("xxxx-xxxx"));
+      *uuid = grub_asprintf ("%04x-%04x",
-      grub_sprintf (*uuid, "%04x-%04x", (grub_uint16_t) (data->uuid >> 16),
+			     (grub_uint16_t) (data->uuid >> 16),
-		    (grub_uint16_t) data->uuid);
+			     (grub_uint16_t) data->uuid);
     }
   else
     *uuid = NULL;

fs/hfs.c

@@ -1082,10 +1082,9 @@ grub_hfs_uuid (grub_device_t device, char **uuid)
   data = grub_hfs_mount (device->disk);
   if (data && data->sblock.num_serial != 0)
     {
-      *uuid = grub_malloc (16 + sizeof ('\0'));
+      *uuid = grub_asprintf ("%016llx",
-      grub_sprintf (*uuid, "%016llx",
+			     (unsigned long long)
-		    (unsigned long long)
+			     grub_be_to_cpu64 (data->sblock.num_serial));
-		    grub_be_to_cpu64 (data->sblock.num_serial));
     }
   else
     *uuid = NULL;

fs/hfsplus.c

@@ -995,10 +995,9 @@ grub_hfsplus_uuid (grub_device_t device, char **uuid)
   data = grub_hfsplus_mount (disk);
   if (data)
     {
-      *uuid = grub_malloc (16 + sizeof ('\0'));
+      *uuid = grub_asprintf ("%016llx",
-      grub_sprintf (*uuid, "%016llx",
+			     (unsigned long long)
-		    (unsigned long long)
+			     grub_be_to_cpu64 (data->volheader.num_serial));
-		    grub_be_to_cpu64 (data->volheader.num_serial));
     }
   else
     *uuid = NULL;

fs/i386/pc/pxe.c

@@ -356,7 +356,8 @@ set_mac_env (grub_uint8_t *mac_addr, grub_size_t mac_len)
 
   for (i = 0; i < mac_len; i++)
     {
-      grub_sprintf (ptr, "%02x:", mac_addr[i] & 0xff);
+      grub_snprintf (ptr, sizeof (buf) - (ptr - buf),
+		     "%02x:", mac_addr[i] & 0xff);
       ptr += (sizeof ("XX:") - 1);
     }
   if (mac_len)
@@ -483,8 +484,8 @@ set_ip_env (char *varname, grub_uint32_t ip)
 {
   char buf[sizeof ("XXX.XXX.XXX.XXX")];
 
-  grub_sprintf (buf, "%d.%d.%d.%d", (ip & 0xff),
+  grub_snprintf (buf, sizeof (buf), "%d.%d.%d.%d", (ip & 0xff),
-		(ip >> 8) & 0xff, (ip >> 16) & 0xff, (ip >> 24) & 0xff);
+		 (ip >> 8) & 0xff, (ip >> 16) & 0xff, (ip >> 24) & 0xff);
   grub_env_set (varname, buf);
 }
 
@@ -500,15 +501,13 @@ write_ip_env (grub_uint32_t *ip, const char *val)
     return 0;
 
   /* Normalize the IP.  */
-  buf = grub_malloc (sizeof ("XXX.XXX.XXX.XXX"));
+  buf = grub_asprintf ("%d.%d.%d.%d", (newip & 0xff), (newip >> 8) & 0xff,
+		       (newip >> 16) & 0xff, (newip >> 24) & 0xff);
   if (!buf)
     return 0;
 
   *ip = newip;
 
-  grub_sprintf (buf, "%d.%d.%d.%d", (newip & 0xff), (newip >> 8) & 0xff,
-		(newip >> 16) & 0xff, (newip >> 24) & 0xff);
-
   return buf; 
 }
 
@@ -544,11 +543,10 @@ grub_env_write_pxe_blocksize (struct grub_env_var *var __attribute__ ((unused)),
   else if (size > GRUB_PXE_MAX_BLKSIZE)
     size = GRUB_PXE_MAX_BLKSIZE;
   
-  buf = grub_malloc (sizeof ("XXXXXX XXXXXX"));
+  buf = grub_asprintf ("%d", size);
   if (!buf)
     return 0;
 
-  grub_sprintf (buf, "%d", size);
   grub_pxe_blksize = size;
   
   return buf;
@@ -562,12 +560,10 @@ GRUB_MOD_INIT(pxe)
     {
       char *buf;
 
-      buf = grub_malloc (sizeof ("XXXXXX XXXXXX"));
+      buf = grub_asprintf ("%d", grub_pxe_blksize);
       if (buf)
-	{
+	grub_env_set ("net_pxe_blksize", buf);
-	  grub_sprintf (buf, "%d", grub_pxe_blksize);
+      grub_free (buf);
-	  grub_env_set ("net_pxe_blksize", buf);
-	}
 
       set_ip_env ("pxe_default_server", grub_pxe_default_server_ip);
       set_ip_env ("pxe_default_gateway", grub_pxe_default_gateway_ip);

fs/iso9660.c

@@ -837,16 +837,23 @@ grub_iso9660_uuid (grub_device_t device, char **uuid)
 	}
       else
 	{
-	  *uuid = grub_malloc (sizeof ("YYYY-MM-DD-HH-mm-ss-hh"));
+	  *uuid = grub_asprintf ("%c%c%c%c-%c%c-%c%c-%c%c-%c%c-%c%c-%c%c",
-	  grub_sprintf (*uuid, "%c%c%c%c-%c%c-%c%c-%c%c-%c%c-%c%c-%c%c",
+				 data->voldesc.modified.year[0],
-			data->voldesc.modified.year[0], data->voldesc.modified.year[1],
+				 data->voldesc.modified.year[1],
-			data->voldesc.modified.year[2], data->voldesc.modified.year[3],
+				 data->voldesc.modified.year[2],
-			data->voldesc.modified.month[0], data->voldesc.modified.month[1],
+				 data->voldesc.modified.year[3],
-			data->voldesc.modified.day[0], data->voldesc.modified.day[1],
+				 data->voldesc.modified.month[0],
-			data->voldesc.modified.hour[0], data->voldesc.modified.hour[1],
+				 data->voldesc.modified.month[1],
-			data->voldesc.modified.minute[0], data->voldesc.modified.minute[1],
+				 data->voldesc.modified.day[0],
-			data->voldesc.modified.second[0], data->voldesc.modified.second[1],
+				 data->voldesc.modified.day[1],
-			data->voldesc.modified.hundredth[0], data->voldesc.modified.hundredth[1]);
+				 data->voldesc.modified.hour[0],
+				 data->voldesc.modified.hour[1],
+				 data->voldesc.modified.minute[0],
+				 data->voldesc.modified.minute[1],
+				 data->voldesc.modified.second[0],
+				 data->voldesc.modified.second[1],
+				 data->voldesc.modified.hundredth[0],
+				 data->voldesc.modified.hundredth[1]);
 	}
     }
   else

fs/jfs.c

@@ -842,17 +842,16 @@ grub_jfs_uuid (grub_device_t device, char **uuid)
   data = grub_jfs_mount (disk);
   if (data)
     {
-      *uuid = grub_malloc (40 + sizeof ('\0'));
+      *uuid = grub_asprintf ("%02x%02x%02x%02x-%02x%02x-%02x%02x-%02x%02x-"
-
+			     "%02x%02x%02x%02x%02x%02x",
-      grub_sprintf (*uuid, "%02x%02x%02x%02x-%02x%02x-%02x%02x-%02x%02x-%02x%02x%02x%02x%02x%02x",
+			     data->sblock.uuid[0], data->sblock.uuid[1],
-		    data->sblock.uuid[0], data->sblock.uuid[1],
+			     data->sblock.uuid[2], data->sblock.uuid[3],
-		    data->sblock.uuid[2], data->sblock.uuid[3],
+			     data->sblock.uuid[4], data->sblock.uuid[5],
-		    data->sblock.uuid[4], data->sblock.uuid[5],
+			     data->sblock.uuid[6], data->sblock.uuid[7],
-		    data->sblock.uuid[6], data->sblock.uuid[7],
+			     data->sblock.uuid[8], data->sblock.uuid[9],
-		    data->sblock.uuid[8], data->sblock.uuid[9],
+			     data->sblock.uuid[10], data->sblock.uuid[11],
-		    data->sblock.uuid[10], data->sblock.uuid[11],
+			     data->sblock.uuid[12], data->sblock.uuid[13],
-		    data->sblock.uuid[12], data->sblock.uuid[13],
+			     data->sblock.uuid[14], data->sblock.uuid[15]);
-		    data->sblock.uuid[14], data->sblock.uuid[15]);
     }
   else
     *uuid = NULL;

fs/ntfs.c

@@ -1072,8 +1072,7 @@ grub_ntfs_uuid (grub_device_t device, char **uuid)
   data = grub_ntfs_mount (disk);
   if (data)
     {
-      *uuid = grub_malloc (16 + sizeof ('\0'));
+      *uuid = grub_asprintf ("%016llx", (unsigned long long) data->uuid);
-      grub_sprintf (*uuid, "%016llx", (unsigned long long) data->uuid);
     }
   else
     *uuid = NULL;

fs/reiserfs.c

@@ -1335,12 +1335,15 @@ grub_reiserfs_uuid (grub_device_t device, char **uuid)
   data = grub_reiserfs_mount (disk);
   if (data)
     {
-      *uuid = grub_malloc (sizeof ("xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"));
+      *uuid = grub_asprintf ("%04x%04x-%04x-%04x-%04x-%04x%04x%04x",
-      grub_sprintf (*uuid, "%04x%04x-%04x-%04x-%04x-%04x%04x%04x",
+			     grub_be_to_cpu16 (data->superblock.uuid[0]),
-		    grub_be_to_cpu16 (data->superblock.uuid[0]), grub_be_to_cpu16 (data->superblock.uuid[1]),
+			     grub_be_to_cpu16 (data->superblock.uuid[1]),
-		    grub_be_to_cpu16 (data->superblock.uuid[2]), grub_be_to_cpu16 (data->superblock.uuid[3]),
+			     grub_be_to_cpu16 (data->superblock.uuid[2]),
-		    grub_be_to_cpu16 (data->superblock.uuid[4]), grub_be_to_cpu16 (data->superblock.uuid[5]),
+			     grub_be_to_cpu16 (data->superblock.uuid[3]),
-		    grub_be_to_cpu16 (data->superblock.uuid[6]), grub_be_to_cpu16 (data->superblock.uuid[7]));
+			     grub_be_to_cpu16 (data->superblock.uuid[4]),
+			     grub_be_to_cpu16 (data->superblock.uuid[5]),
+			     grub_be_to_cpu16 (data->superblock.uuid[6]),
+			     grub_be_to_cpu16 (data->superblock.uuid[7]));
     }
   else
     *uuid = NULL;

fs/ufs.c

@@ -732,12 +732,9 @@ grub_ufs_uuid (grub_device_t device, char **uuid)
 
   data = grub_ufs_mount (disk);
   if (data && (data->sblock.uuidhi != 0 || data->sblock.uuidlow != 0))
-    {
+    *uuid = grub_asprintf ("%08x%08x",
-      *uuid = grub_malloc (16 + sizeof ('\0'));
+			   (unsigned) grub_le_to_cpu32 (data->sblock.uuidhi),
-      grub_sprintf (*uuid, "%08x%08x",
+			   (unsigned) grub_le_to_cpu32 (data->sblock.uuidlow));
-		    (unsigned) grub_le_to_cpu32 (data->sblock.uuidhi),
-		    (unsigned) grub_le_to_cpu32 (data->sblock.uuidlow));
-    }
   else
     *uuid = NULL;
 

fs/xfs.c

@@ -777,12 +777,15 @@ grub_xfs_uuid (grub_device_t device, char **uuid)
   data = grub_xfs_mount (disk);
   if (data)
     {
-      *uuid = grub_malloc (sizeof ("xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"));
+      *uuid = grub_asprintf ("%04x%04x-%04x-%04x-%04x-%04x%04x%04x",
-      grub_sprintf (*uuid, "%04x%04x-%04x-%04x-%04x-%04x%04x%04x",
+			     grub_be_to_cpu16 (data->sblock.uuid[0]),
-		    grub_be_to_cpu16 (data->sblock.uuid[0]), grub_be_to_cpu16 (data->sblock.uuid[1]),
+			     grub_be_to_cpu16 (data->sblock.uuid[1]),
-		    grub_be_to_cpu16 (data->sblock.uuid[2]), grub_be_to_cpu16 (data->sblock.uuid[3]),
+			     grub_be_to_cpu16 (data->sblock.uuid[2]),
-		    grub_be_to_cpu16 (data->sblock.uuid[4]), grub_be_to_cpu16 (data->sblock.uuid[5]),
+			     grub_be_to_cpu16 (data->sblock.uuid[3]),
-		    grub_be_to_cpu16 (data->sblock.uuid[6]), grub_be_to_cpu16 (data->sblock.uuid[7]));
+			     grub_be_to_cpu16 (data->sblock.uuid[4]),
+			     grub_be_to_cpu16 (data->sblock.uuid[5]),
+			     grub_be_to_cpu16 (data->sblock.uuid[6]),
+			     grub_be_to_cpu16 (data->sblock.uuid[7]));
     }
   else
     *uuid = NULL;

gettext/gettext.c

@@ -275,14 +275,19 @@ grub_gettext_init_ext (const char *lang)
   /* Warning: if changing some paths in the below line, change the grub_malloc
      contents below.  */
 
-  grub_sprintf (mo_file, "%s/%s.mo", locale_dir, lang);
+  mo_file = grub_asprintf ("%s/%s.mo", locale_dir, lang);
+  if (!mo_file)
+    return;
 
   fd_mo = grub_mofile_open (mo_file);
 
   /* Will try adding .gz as well.  */
   if (fd_mo == NULL)
     {
-      grub_sprintf (mo_file, "%s.gz", mo_file);
+      grub_free (mo_file);
+      mo_file = grub_asprintf ("%s.gz", mo_file);
+      if (!mo_file)
+	return;
       fd_mo = grub_mofile_open (mo_file);
     }
 

hook/datehook.c

@@ -76,7 +76,7 @@ grub_read_hook_datetime (struct grub_env_var *var,
                 return grub_get_weekday_name (&datetime);
               }
 
-            grub_sprintf (buf, "%d", n);
+            grub_snprintf (buf, sizeof (buf), "%d", n);
             break;
           }
     }

include/grub/misc.h

@@ -179,8 +179,13 @@ void EXPORT_FUNC(grub_real_dprintf) (const char *file,
                                      const char *condition,
                                      const char *fmt, ...) __attribute__ ((format (printf, 4, 5)));
 int EXPORT_FUNC(grub_vprintf) (const char *fmt, va_list args);
-int EXPORT_FUNC(grub_sprintf) (char *str, const char *fmt, ...) __attribute__ ((format (printf, 2, 3)));
+int EXPORT_FUNC(grub_snprintf) (char *str, grub_size_t n, const char *fmt, ...)
-int EXPORT_FUNC(grub_vsprintf) (char *str, const char *fmt, va_list args);
+     __attribute__ ((format (printf, 3, 4)));
+int EXPORT_FUNC(grub_vsnprintf) (char *str, grub_size_t n, const char *fmt,
+				 va_list args);
+char *EXPORT_FUNC(grub_asprintf) (const char *fmt, ...)
+     __attribute__ ((format (printf, 1, 2)));
+char *EXPORT_FUNC(grub_avsprintf) (const char *fmt, va_list args);
 void EXPORT_FUNC(grub_exit) (void) __attribute__ ((noreturn));
 void EXPORT_FUNC(grub_abort) (void) __attribute__ ((noreturn));
 grub_ssize_t EXPORT_FUNC(grub_utf8_to_ucs4) (grub_uint32_t *dest,

kern/device.c

@@ -86,7 +86,7 @@ grub_device_iterate (int (*hook) (const char *name))
   struct part_ent
   {
     struct part_ent *next;
-    char name[0];
+    char *name;
   } *ents;
 
   int iterate_disk (const char *disk_name)
@@ -118,6 +118,7 @@ grub_device_iterate (int (*hook) (const char *name))
 
 	      if (!ret)
 		ret = hook (p->name);
+	      grub_free (p->name);
 	      grub_free (p);
 	      p = next;
 	    }
@@ -138,15 +139,20 @@ grub_device_iterate (int (*hook) (const char *name))
       if (! partition_name)
 	return 1;
 
-      p = grub_malloc (sizeof (p->next) + grub_strlen (disk->name) + 1 +
+      p = grub_malloc (sizeof (p->next));
-		       grub_strlen (partition_name) + 1);
       if (!p)
 	{
 	  grub_free (partition_name);
 	  return 1;
 	}
 
-      grub_sprintf (p->name, "%s,%s", disk->name, partition_name);
+      p->name = grub_asprintf ("%s,%s", disk->name, partition_name);
+      if (!p->name)
+	{
+	  grub_free (partition_name);
+	  grub_free (p);
+	  return 1;
+	}      
       grub_free (partition_name);
 
       p->next = ents;

kern/dl.c

@@ -628,12 +628,10 @@ grub_dl_load (const char *name)
     return 0;
   }
 
-  filename = (char *) grub_malloc (grub_strlen (grub_dl_dir) + 1
+  filename = grub_asprintf ("%s/%s.mod", grub_dl_dir, name);
-				   + grub_strlen (name) + 4 + 1);
   if (! filename)
     return 0;
 
-  grub_sprintf (filename, "%s/%s.mod", grub_dl_dir, name);
   mod = grub_dl_load_file (filename);
   grub_free (filename);
 

kern/efi/init.c

@@ -63,11 +63,10 @@ grub_efi_set_prefix (void)
 	  if (p)
 	    *p = '\0';
 
-	  prefix = grub_malloc (1 + grub_strlen (device) + 1
+	  prefix = grub_asprintf ("(%s)%s", device, file);
-				+ grub_strlen (file) + 1);
 	  if (prefix)
 	    {
-	      grub_sprintf (prefix, "(%s)%s", device, file);
+	      
 	      grub_env_set ("prefix", prefix);
 	      grub_free (prefix);
 	    }

kern/env.c

@@ -356,14 +356,7 @@ grub_register_variable_hook (const char *name,
 static char *
 mangle_data_slot_name (const char *name)
 {
-  char *mangled_name;
+  return grub_asprintf ("\e%s", name);
-
-  mangled_name = grub_malloc (grub_strlen (name) + 2);
-  if (! mangled_name)
-    return 0;
-
-  grub_sprintf (mangled_name, "\e%s", name);
-  return mangled_name;
 }
 
 grub_err_t

kern/err.c

@@ -44,7 +44,7 @@ grub_error (grub_err_t n, const char *fmt, ...)
   grub_errno = n;
 
   va_start (ap, fmt);
-  grub_vsprintf (grub_errmsg, fmt, ap);
+  grub_vsnprintf (grub_errmsg, sizeof (grub_errmsg), fmt, ap);
   va_end (ap);
 
   return n;

kern/i386/pc/init.c

@@ -56,22 +56,30 @@ static char *
 make_install_device (void)
 {
   /* XXX: This should be enough.  */
-  char dev[100];
+  char dev[100], *ptr = dev;
 
   if (grub_prefix[0] != '(')
     {
       /* No hardcoded root partition - make it from the boot drive and the
 	 partition number encoded at the install time.  */
-      grub_sprintf (dev, "(%cd%u", (grub_boot_drive & 0x80) ? 'h' : 'f',
+      grub_snprintf (dev, sizeof (dev),
+		    "(%cd%u", (grub_boot_drive & 0x80) ? 'h' : 'f',
 		    grub_boot_drive & 0x7f);
+      ptr += grub_strlen (ptr);
 
       if (grub_install_dos_part >= 0)
-	grub_sprintf (dev + grub_strlen (dev), ",%u", grub_install_dos_part + 1);
+	grub_snprintf (ptr, sizeof (dev) - (ptr - dev),
+		       ",%u", grub_install_dos_part + 1);
+
+      ptr += grub_strlen (ptr);
 
       if (grub_install_bsd_part >= 0)
-	grub_sprintf (dev + grub_strlen (dev), ",%c", grub_install_bsd_part + 'a');
+	grub_snprintf (ptr, sizeof (dev) - (ptr - dev), ",%c",
+		       grub_install_bsd_part + 'a');
 
-      grub_sprintf (dev + grub_strlen (dev), ")%s", grub_prefix);
+      ptr += grub_strlen (ptr);
+
+      grub_snprintf (ptr, sizeof (dev) - (ptr - dev), ")%s", grub_prefix);
       grub_strcpy (grub_prefix, dev);
     }
 

kern/ieee1275/init.c

@@ -111,11 +111,12 @@ grub_machine_set_prefix (void)
 	  *lastslash = '\0';
 	  grub_translate_ieee1275_path (filename);
 
-	  newprefix = grub_malloc (grub_strlen (prefix)
+	  newprefix = grub_asprintf ("%s%s", prefix, filename);
-				   + grub_strlen (filename));
+	  if (newprefix)
-	  grub_sprintf (newprefix, "%s%s", prefix, filename);
+	    {
-	  grub_free (prefix);
+	      grub_free (prefix);
-	  prefix = newprefix;
+	      prefix = newprefix;
+	    }
 	}
     }
 

kern/ieee1275/openfw.c

@@ -38,7 +38,7 @@ grub_children_iterate (char *devpath,
   grub_ieee1275_phandle_t dev;
   grub_ieee1275_phandle_t child;
   char *childtype, *childpath;
-  char *childname, *fullname;
+  char *childname;
   int ret = 0;
 
   if (grub_ieee1275_finddevice (devpath, &dev))
@@ -63,19 +63,12 @@ grub_children_iterate (char *devpath,
       grub_free (childtype);
       return 0;
     }
-  fullname = grub_malloc (IEEE1275_MAX_PATH_LEN);
-  if (!fullname)
-    {
-      grub_free (childname);
-      grub_free (childpath);
-      grub_free (childtype);
-      return 0;
-    }
 
   do
     {
       struct grub_ieee1275_devalias alias;
       grub_ssize_t actual;
+      char *fullname;
 
       if (grub_ieee1275_get_property (child, "device_type", childtype,
 				      IEEE1275_MAX_PROP_LEN, &actual))
@@ -89,18 +82,25 @@ grub_children_iterate (char *devpath,
 				      IEEE1275_MAX_PROP_LEN, &actual))
 	continue;
 
-      grub_sprintf (fullname, "%s/%s", devpath, childname);
+      fullname = grub_asprintf ("%s/%s", devpath, childname);
+      if (!fullname)
+	{
+	  grub_free (childname);
+	  grub_free (childpath);
+	  grub_free (childtype);
+	  return 0;
+	}
 
       alias.type = childtype;
       alias.path = childpath;
       alias.name = fullname;
       ret = hook (&alias);
+      grub_free (fullname);
       if (ret)
 	break;
     }
   while (grub_ieee1275_peer (child, &child));
 
-  grub_free (fullname);
   grub_free (childname);
   grub_free (childpath);
   grub_free (childtype);
@@ -330,12 +330,11 @@ grub_ieee1275_parse_args (const char *path, enum grub_ieee1275_parse_type ptype)
 	    {
 	      char *filepath = comma + 1;
 
-	      ret = grub_malloc (grub_strlen (filepath) + 1);
 	      /* Make sure filepath has leading backslash.  */
 	      if (filepath[0] != '\\')
-		grub_sprintf (ret, "\\%s", filepath);
+		ret = grub_asprintf ("\\%s", filepath);
 	      else
-		grub_strcpy (ret, filepath);
+		ret = grub_strdup (filepath);
 	    }
 	}
       else if (ptype == GRUB_PARSE_PARTITION)
@@ -383,15 +382,10 @@ grub_ieee1275_encode_devname (const char *path)
 	/* GRUB partition 1 is OF partition 0.  */
 	partno++;
 
-      /* Assume partno will require less than five bytes to encode.  */
+      encoding = grub_asprintf ("(%s,%d)", device, partno);
-      encoding = grub_malloc (grub_strlen (device) + 3 + 5);
-      grub_sprintf (encoding, "(%s,%d)", device, partno);
     }
   else
-    {
+    encoding = grub_asprintf ("(%s)", device);
-      encoding = grub_malloc (grub_strlen (device) + 2);
-      grub_sprintf (encoding, "(%s)", device);
-    }
 
   grub_free (partition);
   grub_free (device);

kern/misc.c

@@ -25,6 +25,9 @@
 #include <grub/env.h>
 #include <grub/i18n.h>
 
+static int
+grub_vsnprintf_real (char *str, grub_size_t n, const char *fmt, va_list args);
+
 static int
 grub_iswordseparator (int c)
 {
@@ -202,7 +205,7 @@ grub_vprintf (const char *fmt, va_list args)
 {
   int ret;
 
-  ret = grub_vsprintf (0, fmt, args);
+  ret = grub_vsnprintf_real (0, 0, fmt, args);
   grub_refresh ();
   return ret;
 }
@@ -626,11 +629,11 @@ grub_lltoa (char *str, int c, unsigned long long n)
   return p;
 }
 
-int
+static int
-grub_vsprintf (char *str, const char *fmt, va_list args)
+grub_vsnprintf_real (char *str, grub_size_t n, const char *fmt, va_list args)
 {
   char c;
-  int count = 0;
+  grub_size_t count = 0;
   auto void write_char (unsigned char ch);
   auto void write_str (const char *s);
   auto void write_fill (const char ch, int n);
@@ -638,7 +641,10 @@ grub_vsprintf (char *str, const char *fmt, va_list args)
   void write_char (unsigned char ch)
     {
       if (str)
-	*str++ = ch;
+	{
+	  if (count < n)
+	    *str++ = ch;
+	}
       else
 	grub_putchar (ch);
 
@@ -867,13 +873,64 @@ grub_vsprintf (char *str, const char *fmt, va_list args)
 }
 
 int
-grub_sprintf (char *str, const char *fmt, ...)
+grub_vsnprintf (char *str, grub_size_t n, const char *fmt, va_list ap)
+{
+  grub_size_t ret;
+
+  if (!n)
+    return 0;
+
+  n--;
+
+  ret = grub_vsnprintf_real (str, n, fmt, ap);
+
+  return ret < n ? ret : n;
+}
+
+int
+grub_snprintf (char *str, grub_size_t n, const char *fmt, ...)
 {
   va_list ap;
   int ret;
 
   va_start (ap, fmt);
-  ret = grub_vsprintf (str, fmt, ap);
+  ret = grub_vsnprintf (str, n, fmt, ap);
+  va_end (ap);
+
+  return ret;
+}
+
+#define PREALLOC_SIZE 255
+
+char *
+grub_avsprintf (const char *fmt, va_list ap)
+{
+  grub_size_t s, as = PREALLOC_SIZE;
+  char *ret;
+
+  while (1)
+    {
+      ret = grub_malloc (as + 1);
+      if (!ret)
+	return NULL;
+
+      s = grub_vsnprintf (ret, as, fmt, ap);
+      if (s <= as)
+	return ret;
+
+      grub_free (ret);
+      as = s;
+    }
+}
+
+char *
+grub_asprintf (const char *fmt, ...)
+{
+  va_list ap;
+  char *ret;
+
+  va_start (ap, fmt);
+  ret = grub_avsprintf (fmt, ap);
   va_end (ap);
 
   return ret;

kern/sparc64/ieee1275/init.c

@@ -90,10 +90,7 @@ grub_machine_set_prefix (void)
 	}
       prefix = grub_ieee1275_encode_devname (bootpath);
 
-      path = grub_malloc (grub_strlen (grub_prefix)
+      path = grub_asprintf("%s%s", prefix, grub_prefix);
-			  + grub_strlen (prefix)
-			  + 2);
-      grub_sprintf(path, "%s%s", prefix, grub_prefix);
 
       grub_strcpy (grub_prefix, path);
 

lib/hexdump.c

@@ -31,21 +31,22 @@ hexdump (unsigned long bse, char *buf, int len)
     {
       int cnt, i;
 
-      pos = grub_sprintf (line, "%08lx  ", bse);
+      pos = grub_snprintf (line, sizeof (line), "%08lx  ", bse);
       cnt = 16;
       if (cnt > len)
 	cnt = len;
 
       for (i = 0; i < cnt; i++)
 	{
-	  pos += grub_sprintf (&line[pos], "%02x ", (unsigned char) buf[i]);
+	  pos += grub_snprintf (&line[pos], sizeof (line) - pos,
+				"%02x ", (unsigned char) buf[i]);
 	  if ((i & 7) == 7)
 	    line[pos++] = ' ';
 	}
 
       for (; i < 16; i++)
 	{
-	  pos += grub_sprintf (&line[pos], "   ");
+	  pos += grub_snprintf (&line[pos], sizeof (line) - pos, "   ");
 	  if ((i & 7) == 7)
 	    line[pos++] = ' ';
 	}

loader/i386/bsd.c

@@ -1138,14 +1138,20 @@ grub_cmd_freebsd_loadenv (grub_command_t cmd __attribute__ ((unused)),
 
       if (*curr)
 	{
-	  char name[grub_strlen (curr) + sizeof("kFreeBSD.")];
+	  char *name;
 
 	  if (*p == '"')
 	    p++;
 
-	  grub_sprintf (name, "kFreeBSD.%s", curr);
+	  name = grub_asprintf ("kFreeBSD.%s", curr);
-	  if (grub_env_set (name, p))
+	  if (!name)
 	    goto fail;
+	  if (grub_env_set (name, p))
+	    {
+	      grub_free (name);
+	      goto fail;
+	    }
+	  grub_free (name);
 	}
     }
 

loader/i386/linux.c

@@ -517,11 +517,9 @@ grub_linux_boot (void)
      May change in future if we have modes without framebuffer.  */
   if (modevar && *modevar != 0)
     {
-      tmp = grub_malloc (grub_strlen (modevar)
+      tmp = grub_asprintf ("%s;text", modevar);
-			 + sizeof (";text"));
       if (! tmp)
 	return grub_errno;
-      grub_sprintf (tmp, "%s;text", modevar);
       err = grub_video_set_mode (tmp, 0);
       grub_free (tmp);
     }
@@ -779,19 +777,18 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
 		break;
 	      }
 
-	    buf = grub_malloc (sizeof ("WWWWxHHHHxDD;WWWWxHHHH"));
-	    if (! buf)
-	      goto fail;
-
 	    linux_mode
 	      = &linux_vesafb_modes[vid_mode - GRUB_LINUX_VID_MODE_VESA_START];
 
-	    grub_sprintf (buf, "%ux%ux%u,%ux%u",
+	    buf = grub_asprintf ("%ux%ux%u,%ux%u",
-			  linux_vesafb_res[linux_mode->res_index].width,
+				 linux_vesafb_res[linux_mode->res_index].width,
-			  linux_vesafb_res[linux_mode->res_index].height,
+				 linux_vesafb_res[linux_mode->res_index].height,
-			  linux_mode->depth,
+				 linux_mode->depth,
-			  linux_vesafb_res[linux_mode->res_index].width,
+				 linux_vesafb_res[linux_mode->res_index].width,
-			  linux_vesafb_res[linux_mode->res_index].height);
+				 linux_vesafb_res[linux_mode->res_index].height);
+	    if (! buf)
+	      goto fail;
+
 	    grub_printf ("%s is deprecated. "
 			 "Use set gfxpayload=%s before "
 			 "linux command instead.\n",

loader/i386/pc/xnu.c

@@ -52,12 +52,10 @@ grub_xnu_set_video (struct grub_xnu_boot_params *params)
     err = grub_video_set_mode (DEFAULT_VIDEO_MODE, video_hook);
   else
     {
-      tmp = grub_malloc (grub_strlen (modevar)
+      tmp = grub_asprintf ("%s;" DEFAULT_VIDEO_MODE, modevar);
-			 + sizeof (DEFAULT_VIDEO_MODE) + 1);
       if (! tmp)
 	return grub_error (GRUB_ERR_OUT_OF_MEMORY,
 			   "couldn't allocate temporary storag");
-      grub_sprintf (tmp, "%s;" DEFAULT_VIDEO_MODE, modevar);
       err = grub_video_set_mode (tmp, video_hook);
       grub_free (tmp);
     }

loader/i386/xnu.c

@@ -748,11 +748,13 @@ grub_cpu_xnu_fill_devicetree (void)
 #endif
 
       /* The name of key for new table. */
-      grub_sprintf (guidbuf, "%08x-%04x-%04x-%02x%02x-",
+      grub_snprintf (guidbuf, sizeof (guidbuf), "%08x-%04x-%04x-%02x%02x-",
-		    guid.data1, guid.data2, guid.data3, guid.data4[0],
+		     guid.data1, guid.data2, guid.data3, guid.data4[0],
-		    guid.data4[1]);
+		     guid.data4[1]);
       for (j = 2; j < 8; j++)
-	grub_sprintf (guidbuf + grub_strlen (guidbuf), "%02x", guid.data4[j]);
+	grub_snprintf (guidbuf + grub_strlen (guidbuf),
+		       sizeof (guidbuf) - grub_strlen (guidbuf),
+		       "%02x", guid.data4[j]);
       /* For some reason GUID has to be in uppercase. */
       for (j = 0; guidbuf[j] ; j++)
 	if (guidbuf[j] >= 'a' && guidbuf[j] <= 'f')

loader/xnu.c

@@ -568,10 +568,9 @@ grub_xnu_register_memory (char *prefix, int *suffix,
     return grub_error (GRUB_ERR_OUT_OF_MEMORY, "can't register memory");
   if (suffix)
     {
-      driverkey->name = grub_malloc (grub_strlen (prefix) + 10);
+      driverkey->name = grub_asprintf ("%s%d", prefix, (*suffix)++);
       if (!driverkey->name)
 	return grub_error (GRUB_ERR_OUT_OF_MEMORY, "can't register memory");
-      grub_sprintf (driverkey->name, "%s%d", prefix, (*suffix)++);
     }
   else
     driverkey->name = grub_strdup (prefix);

normal/autofs.c

@@ -63,12 +63,11 @@ read_fs_list (void)
     {
       char *filename;
 
-      filename = grub_malloc (grub_strlen (prefix) + sizeof ("/fs.lst"));
+      filename = grub_asprintf ("%s/fs.lst", prefix);
       if (filename)
 	{
 	  grub_file_t file;
 
-	  grub_sprintf (filename, "%s/fs.lst", prefix);
 	  file = grub_file_open (filename);
 	  if (file)
 	    {

normal/completion.c

@@ -107,17 +107,12 @@ iterate_partition (grub_disk_t disk, const grub_partition_t p)
   if (! partition_name)
     return 1;
 
-  name = grub_malloc (grub_strlen (disk_name) + 1
+  name = grub_asprintf ("%s,%s", disk_name, partition_name);
-		      + grub_strlen (partition_name) + 1);
-  if (! name)
-    {
-      grub_free (partition_name);
-      return 1;
-    }
-
-  grub_sprintf (name, "%s,%s", disk_name, partition_name);
   grub_free (partition_name);
 
+  if (! name)
+    return 1;
+
   ret = add_completion (name, ")", GRUB_COMPLETION_TYPE_PARTITION);
   grub_free (name);
   return ret;
@@ -141,11 +136,15 @@ iterate_dir (const char *filename, const struct grub_dirhook_info *info)
     }
   else if (grub_strcmp (filename, ".") && grub_strcmp (filename, ".."))
     {
-      char fname[grub_strlen (filename) + 2];
+      char *fname;
 
-      grub_sprintf (fname, "%s/", filename);
+      fname = grub_asprintf ("%s/", filename);
       if (add_completion (fname, "", GRUB_COMPLETION_TYPE_FILE))
-	return 1;
+	{
+	  grub_free (fname);
+	  return 1;
+	}
+      grub_free (fname);
     }
 
   return 0;
@@ -360,8 +359,9 @@ complete_arguments (char *command)
       if (!option->longarg)
 	continue;
 
-      longarg = grub_malloc (grub_strlen (option->longarg));
+      longarg = grub_asprintf ("--%s", option->longarg);
-      grub_sprintf (longarg, "--%s", option->longarg);
+      if (!longarg)
+	return 1;
 
       if (add_completion (longarg, " ", GRUB_COMPLETION_TYPE_ARGUMENT))
 	{

normal/dyncmd.c

@@ -75,12 +75,11 @@ read_command_list (void)
     {
       char *filename;
 
-      filename = grub_malloc (grub_strlen (prefix) + sizeof ("/command.lst"));
+      filename = grub_asprintf ("%s/command.lst", prefix);
       if (filename)
 	{
 	  grub_file_t file;
 
-	  grub_sprintf (filename, "%s/command.lst", prefix);
 	  file = grub_file_open (filename);
 	  if (file)
 	    {

normal/handler.c

@@ -172,12 +172,11 @@ read_handler_list (void)
     {
       char *filename;
 
-      filename = grub_malloc (grub_strlen (prefix) + sizeof ("/handler.lst"));
+      filename = grub_asprintf ("%s/handler.lst", prefix);
       if (filename)
 	{
 	  grub_file_t file;
 
-	  grub_sprintf (filename, "%s/handler.lst", prefix);
 	  file = grub_file_open (filename);
 	  if (file)
 	    {

normal/main.c

@@ -389,16 +389,17 @@ grub_normal_init_page (void)
   int posx;
   const char *msg = _("GNU GRUB  version %s");
 
-  char *msg_formatted = grub_malloc (grub_strlen(msg) +
+  char *msg_formatted;
-  				     grub_strlen(PACKAGE_VERSION));
- 
-  grub_cls ();
-
-  grub_sprintf (msg_formatted, msg, PACKAGE_VERSION);
 
   grub_uint32_t *unicode_msg;
   grub_uint32_t *last_position;
  
+  grub_cls ();
+
+  msg_formatted = grub_asprintf (msg, PACKAGE_VERSION);
+  if (!msg_formatted)
+    return;
+ 
   msg_len = grub_utf8_to_ucs4_alloc (msg_formatted,
   				     &unicode_msg, &last_position);
  
@@ -475,11 +476,10 @@ grub_cmd_normal (struct grub_command *cmd,
       prefix = grub_env_get ("prefix");
       if (prefix)
 	{
-	  config = grub_malloc (grub_strlen (prefix) + sizeof ("/grub.cfg"));
+	  config = grub_asprintf ("%s/grub.cfg", prefix);
 	  if (! config)
 	    goto quit;
 
-	  grub_sprintf (config, "%s/grub.cfg", prefix);
 	  grub_enter_normal_mode (config);
 	  grub_free (config);
 	}
@@ -528,10 +528,11 @@ grub_normal_reader_init (void)
 
   const char *msg_esc = _("ESC at any time exits.");
 
-  char *msg_formatted = grub_malloc (sizeof (char) * (grub_strlen (msg) +
+  char *msg_formatted;
-                grub_strlen(msg_esc) + 1));
 
-  grub_sprintf (msg_formatted, msg, reader_nested ? msg_esc : "");
+  msg_formatted = grub_asprintf (msg, reader_nested ? msg_esc : "");
+  if (!msg_formatted)
+    return grub_errno;
   grub_print_message_indented (msg_formatted, 3, STANDARD_MARGIN);
   grub_puts ("\n");
 
@@ -546,9 +547,11 @@ static grub_err_t
 grub_normal_read_line (char **line, int cont)
 {
   grub_parser_t parser = grub_parser_get_current ();
-  char prompt[sizeof(">") + grub_strlen (parser->name)];
+  char *prompt;
 
-  grub_sprintf (prompt, "%s>", parser->name);
+  prompt = grub_asprintf ("%s>", parser->name);
+  if (!prompt)
+    return grub_errno;
 
   while (1)
     {

normal/menu.c

@@ -78,7 +78,7 @@ grub_menu_set_timeout (int timeout)
     {
       char buf[16];
 
-      grub_sprintf (buf, "%d", timeout);
+      grub_snprintf (buf, sizeof (buf), "%d", timeout);
       grub_env_set ("timeout", buf);
     }
 }

normal/menu_text.c

@@ -210,13 +210,14 @@ command-line or ESC to return menu."), STANDARD_MARGIN, STANDARD_MARGIN);
     }
   else
     {
-      const char *msg = _("Use the %C and %C keys to select which \
+      const char *msg = _("Use the %C and %C keys to select which "
-entry is highlighted.\n");
+			  "entry is highlighted.\n");
-      char *msg_translated =
+      char *msg_translated;
-       grub_malloc (sizeof (char) * grub_strlen (msg) + 1);
 
-      grub_sprintf (msg_translated, msg, (grub_uint32_t) GRUB_TERM_DISP_UP,
+      msg_translated = grub_asprintf (msg, (grub_uint32_t) GRUB_TERM_DISP_UP,
-                   (grub_uint32_t) GRUB_TERM_DISP_DOWN);
+				     (grub_uint32_t) GRUB_TERM_DISP_DOWN);
+      if (!msg_translated)
+	return;
       grub_putchar ('\n');
       grub_print_message_indented (msg_translated, STANDARD_MARGIN, STANDARD_MARGIN);
 
@@ -394,13 +395,13 @@ print_timeout (int timeout, int offset)
 {
   const char *msg =
     _("The highlighted entry will be booted automatically in %ds.");
+  char *msg_translated;
 
   grub_gotoxy (0, GRUB_TERM_HEIGHT - 3);
 
-  char *msg_translated =
+  msg_translated = grub_asprintf (msg, timeout);
-    grub_malloc (sizeof (char) * grub_strlen (msg) + 5);
+  if (!msg_translated)
-
+    return;
-  grub_sprintf (msg_translated, msg, timeout);
   grub_print_message_indented (msg_translated, 3, 0);
  
   int posx;

partmap/acorn.c

@@ -175,14 +175,7 @@ fail:
 static char *
 acorn_partition_map_get_name (const grub_partition_t p)
 {
-  char *name;
+  return grub_asprintf ("%d", p->index + 1);
-
-  name = grub_malloc (13);
-  if (! name)
-    return 0;
-
-  grub_sprintf (name, "%d", p->index + 1);
-  return name;
 }
 
 

partmap/amiga.c

@@ -184,14 +184,7 @@ amiga_partition_map_probe (grub_disk_t disk, const char *str)
 static char *
 amiga_partition_map_get_name (const grub_partition_t p)
 {
-  char *name;
+  return grub_asprintf ("%d", p->index + 1);
-
-  name = grub_malloc (13);
-  if (! name)
-    return 0;
-
-  grub_sprintf (name, "%d", p->index + 1);
-  return name;
 }
 
 

partmap/apple.c

@@ -227,14 +227,7 @@ apple_partition_map_probe (grub_disk_t disk, const char *str)
 static char *
 apple_partition_map_get_name (const grub_partition_t p)
 {
-  char *name;
+  return grub_asprintf ("%d", p->index + 1);
-
-  name = grub_malloc (13);
-  if (! name)
-    return 0;
-
-  grub_sprintf (name, "%d", p->index + 1);
-  return name;
 }
 
 

partmap/gpt.c

@@ -162,14 +162,7 @@ gpt_partition_map_probe (grub_disk_t disk, const char *str)
 static char *
 gpt_partition_map_get_name (const grub_partition_t p)
 {
-  char *name;
+  return grub_asprintf ("%d", p->index + 1);
-
-  name = grub_malloc (13);
-  if (! name)
-    return 0;
-
-  grub_sprintf (name, "%d", p->index + 1);
-  return name;
 }
 
 

partmap/msdos.c

@@ -300,21 +300,15 @@ pc_partition_map_probe (grub_disk_t disk, const char *str)
 static char *
 pc_partition_map_get_name (const grub_partition_t p)
 {
-  char *name;
   struct grub_msdos_partition *pcdata = p->data;
 
-  name = grub_malloc (13);
-  if (! name)
-    return 0;
-
   if (pcdata->bsd_part < 0)
-    grub_sprintf (name, "%d", pcdata->dos_part + 1);
+    return grub_asprintf ("%d", pcdata->dos_part + 1);
   else if (pcdata->dos_part < 0)
-    grub_sprintf (name, "%c", pcdata->bsd_part + 'a');
+    return grub_asprintf ("%c", pcdata->bsd_part + 'a');
   else
-    grub_sprintf (name, "%d,%c", pcdata->dos_part + 1, pcdata->bsd_part + 'a');
+    return grub_asprintf ("%d,%c", pcdata->dos_part + 1,
-
+			  pcdata->bsd_part + 'a');
-  return name;
 }
 
 

partmap/sun.c

@@ -184,13 +184,7 @@ sun_partition_map_probe (grub_disk_t disk, const char *str)
 static char *
 sun_partition_map_get_name (const grub_partition_t p)
 {
-  char *name;
+  return grub_asprintf ("%d", p->index + 1);
-
-  name = grub_malloc (13);
-  if (name)
-    grub_sprintf (name, "%d", p->index + 1);
-
-  return name;
 }
 
 /* Partition map type.  */

script/execute.c

@@ -92,7 +92,7 @@ grub_script_execute_cmdline (struct grub_script_cmd *cmd)
   grub_err_t ret = 0;
   int argcount = 0;
   grub_script_function_t func = 0;
-  char errnobuf[6];
+  char errnobuf[18];
   char *cmdname;
 
   /* Lookup the command.  */
@@ -123,7 +123,7 @@ grub_script_execute_cmdline (struct grub_script_cmd *cmd)
 	    }
 	  grub_free (assign);
 
-	  grub_sprintf (errnobuf, "%d", grub_errno);
+	  grub_snprintf (errnobuf, sizeof (errnobuf), "%d", grub_errno);
 	  grub_env_set ("?", errnobuf);
 
 	  return 0;
@@ -156,7 +156,7 @@ grub_script_execute_cmdline (struct grub_script_cmd *cmd)
     grub_free (args[i]);
   grub_free (args);
 
-  grub_sprintf (errnobuf, "%d", ret);
+  grub_snprintf (errnobuf, sizeof (errnobuf), "%d", ret);
   grub_env_set ("?", errnobuf);
 
   return ret;

term/gfxterm.c

@@ -272,9 +272,9 @@ grub_gfxterm_init (void)
     err = grub_video_set_mode (DEFAULT_VIDEO_MODE, video_hook);
   else
     {
-      tmp = grub_malloc (grub_strlen (modevar)
+      tmp = grub_asprintf ("%s;" DEFAULT_VIDEO_MODE, modevar);
-			 + sizeof (DEFAULT_VIDEO_MODE) + 1);
+      if (!tmp)
-      grub_sprintf (tmp, "%s;" DEFAULT_VIDEO_MODE, modevar);
+	return grub_errno;
       err = grub_video_set_mode (tmp, video_hook);
       grub_free (tmp);
     }

term/ieee1275/ofconsole.c

@@ -104,7 +104,7 @@ grub_ofconsole_getcharwidth (grub_uint32_t c __attribute__((unused)))
 static void
 grub_ofconsole_setcolorstate (grub_term_color_state state)
 {
-  char setcol[20];
+  char *setcol;
   int fg;
   int bg;
 
@@ -123,8 +123,10 @@ grub_ofconsole_setcolorstate (grub_term_color_state state)
       return;
     }
 
-  grub_sprintf (setcol, "\e[3%dm\e[4%dm", fg, bg);
+  setcol = grub_asprintf ("\e[3%dm\e[4%dm", fg, bg);
-  grub_ofconsole_writeesc (setcol);
+  if (setcol)
+    grub_ofconsole_writeesc (setcol);
+  grub_free (setcol);
 }
 
 static void
@@ -287,15 +289,16 @@ grub_ofconsole_getwh (void)
 static void
 grub_ofconsole_gotoxy (grub_uint8_t x, grub_uint8_t y)
 {
-  char s[11]; /* 5 + 3 + 3.  */
-
   if (! grub_ieee1275_test_flag (GRUB_IEEE1275_FLAG_NO_ANSI))
     {
+      char *s;
       grub_curr_x = x;
       grub_curr_y = y;
 
-      grub_sprintf (s, "\e[%d;%dH", y + 1, x + 1);
+      s = grub_asprintf ("\e[%d;%dH", y + 1, x + 1);
-      grub_ofconsole_writeesc (s);
+      if (s)
+	grub_ofconsole_writeesc (s);
+      grub_free (s);
     }
   else
     {

term/tparm.c

@@ -167,7 +167,7 @@ save_text(const char *fmt, const char *s, int len)
 
     get_space(s_len + 1);
 
-    (void) grub_sprintf(out_buff + out_used, fmt, s);
+    (void) grub_snprintf(out_buff + out_used, s_len + 1, fmt, s);
     out_used += grub_strlen(out_buff + out_used);
 }
 
@@ -179,7 +179,7 @@ save_number(const char *fmt, int number, int len)
 
     get_space((unsigned) len + 1);
 
-    (void) grub_sprintf(out_buff + out_used, fmt, number);
+    (void) grub_snprintf(out_buff + out_used, len + 1, fmt, number);
     out_used += grub_strlen(out_buff + out_used);
 }
 

util/grub-fstest.c

@@ -278,18 +278,26 @@ cmd_crc (char *pathname)
 static void
 fstest (char **images, int num_disks, int cmd, int n, char **args)
 {
-  char host_file[128];
+  char *host_file;
-  char loop_name[8];
+  char *loop_name;
-  char *argv[3] = { "-p", loop_name, host_file};
+  char *argv[3] = { "-p" };
   int i;
 
   for (i = 0; i < num_disks; i++)
     {
-      if (grub_strlen (images[i]) + 7 > sizeof (host_file))
+      loop_name = grub_asprintf ("loop%d", i);
-        grub_util_error ("Pathname %s too long.", images[i]);
+      host_file = grub_asprintf ("(host)%s", images[i]);
 
-      grub_sprintf (loop_name, "loop%d", i);
+      if (!loop_name || !host_file)
-      grub_sprintf (host_file, "(host)%s", images[i]);
+	{
+	  grub_free (loop_name);
+	  grub_free (host_file);
+	  grub_util_error (grub_errmsg);
+	  return;
+	}
+
+      argv[1] = loop_name;
+      argv[2] = host_file;
 
       if (execute_command ("loopback", 3, argv))
         grub_util_error ("loopback command fails.");
@@ -328,9 +336,19 @@ fstest (char **images, int num_disks, int cmd, int n, char **args)
 
   for (i = 0; i < num_disks; i++)
     {
-      grub_sprintf (loop_name, "loop%d", i);
+      grub_free (loop_name);
+      loop_name = grub_asprintf ("loop%d", i);
+      if (!loop_name)
+	{
+	  grub_free (host_file);
+	  grub_util_error (grub_errmsg);
+	  return;
+	}
       execute_command ("loopback", 2, argv);
     }
+
+  grub_free (loop_name);
+  grub_free (host_file);
 }
 
 static struct option options[] = {