Coverity SECURE_CODING - CID 10339

[Product Strategy Coverity Bug Uploader]

This bug is exported from the Coverity Integration Manager on Canonical's servers. For information on how this is done please see this website: https://wiki.ubuntu.com/CanonicalProductStrategy/Coverity
CID: 10339
Checker: SECURE_CODING
Category: No category available
CWE definition: http://cwe.mitre.org/data/definitions/676.html
File: /tmp/buildd/bamf-0.2.106/build/gtk2/doc/reference/libbamf/libbamf-scan.c
Function: output_object_signal()
Code snippet:
186 /* Output the signal object type and the argument name. We assume the
187 type is a pointer - I think that is OK. We remove "Gtk" or "Gnome" and
188 convert to lower case for the argument name. */
189 pos = buffer;
CID 10339 - SECURE_CODING
[VERY RISKY]. Using "sprintf" can cause a buffer overflow when done incorrectly. Because sprintf() assumes an arbitrarily long string, callers must be careful not to overflow the actual space of the destination. Use snprintf() instead, or correct precision specifiers.
190 sprintf (pos, "%s ", object_name);
191 pos += strlen (pos);
192
193 /* Try to come up with a sensible variable name for the first arg
194 * It chops off 2 know prefixes :/ and makes the name lowercase
195 * It should replace lowercase -> uppercase with '_'

[Product Strategy Coverity Bug Uploader (coverity-uploader)]

Source file with Coverity annotations.

[Product Strategy Coverity Bug Uploader (coverity-uploader)]

Source file with Coverity annotations.

[Product Strategy Coverity Bug Uploader (coverity-uploader)]

Source file with Coverity annotations.

[Product Strategy Coverity Bug Uploader (coverity-uploader)]

Source file with Coverity annotations.