bin/68904: pkg_install fixes (_PATH_*, sprintf -> snprintf, strcpy -> strlcpy)

Cyrille Lefevre cyrille.lefevre at laposte.net
Sat Jul 10 19:20:23 PDT 2004


>Number:         68904
>Category:       bin
>Synopsis:       pkg_install fixes (_PATH_*, sprintf -> snprintf, strcpy -> strlcpy)
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          change-request
>Submitter-Id:   current-users
>Arrival-Date:   Sun Jul 11 02:20:22 GMT 2004
>Closed-Date:
>Last-Modified:
>Originator:     Cyrille Lefevre
>Release:        FreeBSD 5.2-CURRENT i386
>Organization:
ACME
>Environment:
System: FreeBSD gits.gits.invalid 5.2-CURRENT FreeBSD 5.2-CURRENT #35: Sun Jun 20 01:53:37 CEST 2004 root at gits:/disk3/freebsd/current/obj/disk3/freebsd/current/src/sys/CUSTOM i386

>Description:
	lib/lib.h
		*_INSTALL_ARG added
		PKG_*_VNAME added
		TAR_*, GZIP_* and BZIP2_* added
		PKG_SUFX and PKG_TAR_OPT added
	lib/pathnames.h
		new file
		_PATH_* added
	add/add.h, create/create.h, sign/pgp.h, version/version.h
		*_VNAME, *_FNAME added
	*/*.c
		strcpy -> strlcpy whenever possible
		strcat -> strlcat whenever possible
		sprintf -> snprintf
		command and path names -> _PATH_*
		getenv/setenv -> *_VNAME
		#if __FreeBSD_version >= 500039 moved to lib/lib.h
>How-To-Repeat:
	n/a
>Fix:
--- /dev/null	Sun Jul 11 04:00:03 2004
+++ lib/pathnames.h	Sun Jul 11 04:06:34 2004
@@ -0,0 +1,55 @@
+/*-
+ * Copyright (c) 2004 Cyrille Lefevre. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ * 3. The name of the authors and contributors may not be used to
+ *    endorse or promote products derived from this software without
+ *    specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
+ * PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS
+ * OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
+ * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#ifndef _INST_LIB_PATHNAMES_H_
+#define _INST_LIB_PATHNAMES_H_
+
+#define	_PATH_CAT	"/bin/cat"
+#define	_PATH_CHGRP	"/usr/bin/chgrp"
+#define	_PATH_CHMOD	"/bin/chmod"
+#define	_PATH_CHOWN	"/usr/sbin/chown"
+#define	_PATH_MAKE	"/usr/bin/make"
+#define	_PATH_MKDIR	"/bin/mkdir"
+#define	_PATH_MTREE	"/usr/sbin/mtree"
+#define	_PATH_MV	"/bin/mv"
+#define	_PATH_PWD_CMD	"/bin/pwd"	/* _PATH_PWD conflicts w/ <pwd.h> */
+#define	_PATH_PGP	"/usr/local/bin/pgp"
+#define	_PATH_RMDIR	"/bin/rmdir"
+#define	_PATH_TAR	"/usr/bin/tar"
+#define	_PATH_WHICH	"/usr/bin/which"
+
+#define	_PATH_USRPORTS	"/usr/ports"
+#define	_PATH_VARDBPKG	_PATH_VARDB "pkg"
+
+/* Provide trailing slash, since mostly used for building pathnames. */
+#define	_PATH_USRTMP	"/usr/tmp/"
+
+#endif
Index: add/add.h
===================================================================
RCS file: /home/ncvs/src/usr.sbin/pkg_install/add/add.h,v
retrieving revision 1.11
diff -u -I$Id.*$ -I$.+BSD.*$ -r1.11 add.h
--- add/add.h	29 Jun 2004 19:06:41 -0000	1.11
+++ add/add.h	11 Jul 2004 00:58:19 -0000
@@ -23,6 +23,10 @@
 #ifndef _INST_ADD_H_INCLUDE
 #define _INST_ADD_H_INCLUDE
 
+#define	PKG_SITE_VNAME	"PACKAGESITE"
+#define	PKG_ROOT_VNAME	"PACKAGEROOT"
+#define	PKG_TOP_VNAME	"_TOP"
+
 typedef enum { NORMAL, MASTER, SLAVE } add_mode_t;
 
 extern char	*Prefix;
Index: add/extract.c
===================================================================
RCS file: /home/ncvs/src/usr.sbin/pkg_install/add/extract.c,v
retrieving revision 1.41
diff -u -I$Id.*$ -I$.+BSD.*$ -r1.41 extract.c
--- add/extract.c	29 Jun 2004 19:06:41 -0000	1.41
+++ add/extract.c	11 Jul 2004 01:23:18 -0000
@@ -27,21 +27,21 @@
 #include "add.h"
 
 
-#define STARTSTRING "/usr/bin/tar cf -"
+#define STARTSTRING _PATH_TAR " -cf -"
 #define TOOBIG(str) \
     (((int)strlen(str) + FILENAME_MAX + where_count > maxargs) ||\
 	((int)strlen(str) + FILENAME_MAX + perm_count > maxargs))
 
 #define PUSHOUT(todir) /* push out string */ \
     if (where_count > (int)sizeof(STARTSTRING)-1) { \
-	strcat(where_args, "|/usr/bin/tar --unlink -xpf - -C "); \
-	strcat(where_args, todir); \
+	strcat(where_args, "|" _PATH_TAR " --unlink -xpf - -C "); /* safe */ \
+	strcat(where_args, todir);		/* safe */ \
 	if (system(where_args)) { \
 	    cleanup(0); \
 	    errx(2, "%s: can not invoke %ld byte tar pipeline: %s", \
 		 __func__, (long)strlen(where_args), where_args); \
 	} \
-	strcpy(where_args, STARTSTRING); \
+	strcpy(where_args, STARTSTRING);	/* safe */ \
 	where_count = sizeof(STARTSTRING)-1; \
     } \
     if (perm_count) { \
@@ -120,7 +120,7 @@
 	errx(2, "%s: can't get argument list space", __func__);
     }
 
-    strcpy(where_args, STARTSTRING);
+    strcpy(where_args, STARTSTRING);	/* safe */
     where_count = sizeof(STARTSTRING)-1;
     perm_args[0] = 0;
 
Index: add/futil.c
===================================================================
RCS file: /home/ncvs/src/usr.sbin/pkg_install/add/futil.c,v
retrieving revision 1.14
diff -u -I$Id.*$ -I$.+BSD.*$ -r1.14 futil.c
--- add/futil.c	29 Jun 2004 19:06:41 -0000	1.14
+++ add/futil.c	11 Jul 2004 01:02:20 -0000
@@ -50,7 +50,7 @@
 	    }
 	}
 	else {
-	    if (vsystem("/bin/mkdir %s", dir)) {
+	    if (vsystem("%s %s", _PATH_MKDIR, dir)) {
 		if (cp2)
 		    *cp2 = '/';
 		return FAIL;
@@ -78,20 +78,20 @@
 	cd_to = dir;
 
     if (Mode)
-	if (vsystem("cd %s && /bin/chmod -R %s %s", cd_to, Mode, arg))
+	if (vsystem("cd %s && %s -R %s %s", cd_to, _PATH_CHMOD, Mode, arg))
 	    warnx("couldn't change modes of '%s' to '%s'", arg, Mode);
     if (Owner && Group) {
-	if (vsystem("cd %s && /usr/sbin/chown -R %s:%s %s", cd_to, Owner, Group, arg))
+	if (vsystem("cd %s && %s -R %s:%s %s", cd_to, _PATH_CHOWN, Owner, Group, arg))
 	    warnx("couldn't change owner/group of '%s' to '%s:%s'",
 		   arg, Owner, Group);
 	return;
     }
     if (Owner) {
-	if (vsystem("cd %s && /usr/sbin/chown -R %s %s", cd_to, Owner, arg))
+	if (vsystem("cd %s && %s -R %s %s", cd_to, _PATH_CHOWN, Owner, arg))
 	    warnx("couldn't change owner of '%s' to '%s'", arg, Owner);
 	return;
     } else if (Group)
-	if (vsystem("cd %s && /usr/bin/chgrp -R %s %s", cd_to, Group, arg))
+	if (vsystem("cd %s && %s -R %s %s", cd_to, _PATH_CHGRP, Group, arg))
 	    warnx("couldn't change group of '%s' to '%s'", arg, Group);
 }
 
Index: add/main.c
===================================================================
RCS file: /home/ncvs/src/usr.sbin/pkg_install/add/main.c,v
retrieving revision 1.58
diff -u -I$Id.*$ -I$.+BSD.*$ -r1.58 main.c
--- add/main.c	29 Jun 2004 19:06:41 -0000	1.58
+++ add/main.c	11 Jul 2004 01:09:13 -0000
@@ -177,12 +177,7 @@
 		if (!((ptr = strrchr(remotepkg, '.')) && ptr[1] == 't' && 
 			(ptr[2] == 'b' || ptr[2] == 'g') && ptr[3] == 'z' &&
 			!ptr[4]))
-		    if (strlcat(remotepkg,
-#if defined(__FreeBSD_version) && __FreeBSD_version >= 500039
-			".tbz",
-#else
-			".tgz",
-#endif
+		    if (strlcat(remotepkg, PKG_SUFX,
 			sizeof(temppackageroot)) >= sizeof(temppackageroot))
 			errx(1, "package name too long");
     	    }
@@ -259,15 +254,15 @@
     static char sitepath[MAXPATHLEN];
     struct utsname u;
 
-    if (getenv("PACKAGESITE")) {
-	if (strlcpy(sitepath, getenv("PACKAGESITE"), sizeof(sitepath))
+    if (getenv(PKG_SITE_VNAME)) {
+	if (strlcpy(sitepath, getenv(PKG_SITE_VNAME), sizeof(sitepath))
 	    >= sizeof(sitepath))
 	    return NULL;
 	return sitepath;
     }
 
-    if (getenv("PACKAGEROOT")) {
-	if (strlcpy(sitepath, getenv("PACKAGEROOT"), sizeof(sitepath))
+    if (getenv(PKG_ROOT_VNAME)) {
+	if (strlcpy(sitepath, getenv(PKG_ROOT_VNAME), sizeof(sitepath))
 	    >= sizeof(sitepath))
 	    return NULL;
     } else {
Index: add/perform.c
===================================================================
RCS file: /home/ncvs/src/usr.sbin/pkg_install/add/perform.c,v
retrieving revision 1.76
diff -u -I$Id.*$ -I$.+BSD.*$ -r1.76 perform.c
--- add/perform.c	29 Jun 2004 19:06:41 -0000	1.76
+++ add/perform.c	11 Jul 2004 01:54:52 -0000
@@ -22,7 +22,6 @@
 __FBSDID("$FreeBSD$");
 
 #include <err.h>
-#include <paths.h>
 #include "lib.h"
 #include "add.h"
 
@@ -84,7 +83,7 @@
     code = 0;
     zapLogDir = 0;
     LogDir[0] = '\0';
-    strcpy(playpen, FirstPen);
+    strlcpy(playpen, FirstPen, FILENAME_MAX);
     inPlace = 0;
 
     /* Are we coming in for a second pass, everything already extracted? */
@@ -107,7 +106,7 @@
 		return 1;
 	    }
 	    where_to = Home;
-	    strcpy(pkg_fullname, pkg);
+	    strlcpy(pkg_fullname, pkg, FILENAME_MAX);
 	    cfile = fopen(CONTENTS_FNAME, "r");
 	    if (!cfile) {
 		warnx(
@@ -119,16 +118,14 @@
 	    fclose(cfile);
 	}
 	else {
-	    strcpy(pkg_fullname, pkg);		/*
-						 * Copy for sanity's sake,
-						 * could remove pkg_fullname
-						 */
+	    /* Copy for sanity's sake, could remove pkg_fullname */
+	    strlcpy(pkg_fullname, pkg, FILENAME_MAX);
 	    if (strcmp(pkg, "-")) {
 		if (stat(pkg_fullname, &sb) == FAIL) {
 		    warnx("can't stat package file '%s'", pkg_fullname);
 		    goto bomb;
 		}
-		sprintf(extract_contents, "--fast-read %s", CONTENTS_FNAME);
+		snprintf(extract_contents, FILENAME_MAX, "--fast-read %s", CONTENTS_FNAME);
 		extract = extract_contents;
 	    }
 	    else {
@@ -140,8 +137,8 @@
 		errx(1, "unable to make playpen for %qd bytes", (long long)sb.st_size * 4);
 	    where_to = Home;
 	    /* Since we can call ourselves recursively, keep notes on where we came from */
-	    if (!getenv("_TOP"))
-		setenv("_TOP", Home, 1);
+	    if (!getenv(PKG_TOP_VNAME))
+		setenv(PKG_TOP_VNAME, Home, 1);
 	    if (unpack(pkg_fullname, extract)) {
 		warnx(
 	"unable to extract table of contents file from '%s' - not a package?",
@@ -167,7 +164,7 @@
 		    if (!isdir(p->name) && !Fake) {
 			if (Verbose)
 			    printf("Desired prefix of %s does not exist, creating..\n", p->name);
-			vsystem("/bin/mkdir -p %s", p->name);
+			vsystem("%s -p %s", _PATH_MKDIR, p->name);
 			if (chdir(p->name) == -1) {
 			    warn("unable to change directory to '%s'", p->name);
 			    goto bomb;
@@ -297,17 +294,14 @@
 	    char path[FILENAME_MAX], *cp = NULL;
 
 	    if (!Fake) {
-		if (!isURL(pkg) && !getenv("PKG_ADD_BASE")) {
+		if (!isURL(pkg) && !getenv(PKG_ADDBASE_VNAME)) {
 		    const char *ext;
 
 		    ext = strrchr(pkg_fullname, '.');
 		    if (ext == NULL)
-#if defined(__FreeBSD_version) && __FreeBSD_version >= 500039
-			ext = ".tbz";
-#else
-			ext = ".tgz";
-#endif
-		    snprintf(path, FILENAME_MAX, "%s/%s%s", getenv("_TOP"), p->name, ext);
+			ext = PKG_SUFX,
+		    snprintf(path, FILENAME_MAX, "%s/%s%s",
+		        getenv(PKG_TOP_VNAME), p->name, ext);
 		    if (fexists(path))
 			cp = path;
 		    else
@@ -332,13 +326,15 @@
 		else if ((cp = fileGetURL(pkg, p->name)) != NULL) {
 		    if (Verbose)
 			printf("Finished loading %s over FTP.\n", p->name);
-		    if (!fexists("+CONTENTS")) {
-			warnx("autoloaded package %s has no +CONTENTS file?",
-				p->name);
+		    if (!fexists(CONTENTS_FNAME)) {
+			warnx("autoloaded package %s has no %s file?",
+				p->name, CONTENTS_FNAME);
 			if (!Force)
 			    ++code;
 		    }
-		    else if (vsystem("(pwd; /bin/cat +CONTENTS) | %s %s-S", PkgAddCmd, Verbose ? "-v " : "")) {
+		    else if (vsystem("(%s; %s %s) | %s %s-S",
+		        _PATH_PWD_CMD, _PATH_CAT, CONTENTS_FNAME, PkgAddCmd,
+		        Verbose ? "-v " : "")) {
 			warnx("pkg_add of dependency '%s' failed%s",
 				p->name, Force ? " (proceeding anyway)" : "!");
 			if (!Force)
@@ -369,7 +365,7 @@
 
     /* Look for the requirements file */
     if (fexists(REQUIRE_FNAME)) {
-	vsystem("/bin/chmod +x %s", REQUIRE_FNAME);	/* be sure */
+	vsystem("%s +x %s", _PATH_CHMOD, REQUIRE_FNAME);	/* be sure */
 	if (Verbose)
 	    printf("Running requirements file first for %s..\n", Plist.name);
 	if (!Fake && vsystem("./%s %s INSTALL", REQUIRE_FNAME, Plist.name)) {
@@ -389,20 +385,20 @@
 
     if (fexists(POST_INSTALL_FNAME)) {
 	new_m = 1;
-	sprintf(post_script, "%s", POST_INSTALL_FNAME);
+	snprintf(post_script, FILENAME_MAX, "%s", POST_INSTALL_FNAME);
 	pre_arg[0] = '\0';
 	post_arg[0] = '\0';
     } else {
 	if (fexists(INSTALL_FNAME)) {
-	    sprintf(post_script, "%s", INSTALL_FNAME);
-	    sprintf(pre_arg, "PRE-INSTALL");
-	    sprintf(post_arg, "POST-INSTALL");
+	    snprintf(post_script, FILENAME_MAX, "%s", INSTALL_FNAME);
+	    snprintf(pre_arg, FILENAME_MAX, PRE_INSTALL_ARG);
+	    snprintf(post_arg, FILENAME_MAX, POST_INSTALL_ARG);
 	}
     }
 
     /* If we're really installing, and have an installation file, run it */
     if (!NoInstall && fexists(pre_script)) {
-	vsystem("/bin/chmod +x %s", pre_script);	/* make sure */
+	vsystem("%s +x %s", _PATH_CHMOD, pre_script);	/* make sure */
 	if (Verbose)
 	    printf("Running pre-install for %s..\n", Plist.name);
 	if (!Fake && vsystem("./%s %s %s", pre_script, Plist.name, pre_arg)) {
@@ -424,14 +420,15 @@
 	if (Verbose)
 	    printf("mtree -U -f %s -d -e -p %s >%s\n", MTREE_FNAME, p ? p->name : "/", _PATH_DEVNULL);
 	if (!Fake) {
-	    if (vsystem("/usr/sbin/mtree -U -f %s -d -e -p %s >%s", MTREE_FNAME, p ? p->name : "/", _PATH_DEVNULL))
+	    if (vsystem("%s -U -f %s -d -e -p %s >%s", _PATH_MTREE,
+	        MTREE_FNAME, p ? p->name : "/", _PATH_DEVNULL))
 		warnx("mtree returned a non-zero status - continuing");
 	}
     }
 
     /* Run the installation script one last time? */
     if (!NoInstall && fexists(post_script)) {
-	vsystem("/bin/chmod +x %s", post_script);	/* make sure */
+	vsystem("%s +x %s", _PATH_CHMOD, post_script);	/* make sure */
 	if (Verbose)
 	    printf("Running post-install for %s..\n", Plist.name);
 	if (!Fake && vsystem("./%s %s %s", post_script, Plist.name, post_arg)) {
@@ -449,7 +446,7 @@
 
 	if (getuid() != 0)
 	    warnx("not running as root - trying to record install anyway");
-	sprintf(LogDir, "%s/%s", LOG_DIR, Plist.name);
+	snprintf(LogDir, FILENAME_MAX, "%s/%s", LOG_DIR, Plist.name);
 	zapLogDir = 1;
 	if (Verbose)
 	    printf("Attempting to record package into %s..\n", LogDir);
@@ -461,7 +458,7 @@
 	    goto success;	/* close enough for government work */
 	}
 	/* Make sure pkg_info can read the entry */
-	vsystem("/bin/chmod a+rx %s", LogDir);
+	vsystem("%s a+rx %s", _PATH_CHMOD, LogDir);
 	move_file(".", DESC_FNAME, LogDir);
 	move_file(".", COMMENT_FNAME, LogDir);
 	if (fexists(INSTALL_FNAME))
@@ -478,7 +475,7 @@
 	    move_file(".", DISPLAY_FNAME, LogDir);
 	if (fexists(MTREE_FNAME))
 	    move_file(".", MTREE_FNAME, LogDir);
-	sprintf(contents, "%s/%s", LogDir, CONTENTS_FNAME);
+	snprintf(contents, FILENAME_MAX, "%s/%s", LogDir, CONTENTS_FNAME);
 	contfile = fopen(contents, "w");
 	if (!contfile) {
 	    warnx("can't open new contents file '%s'! can't register pkg",
@@ -510,7 +507,7 @@
 		depnames[1] = NULL;
 	    }
 	    for (i = 0; depnames[i] != NULL; i++) {
-		sprintf(contents, "%s/%s/%s", LOG_DIR, depnames[i],
+		snprintf(contents, FILENAME_MAX, "%s/%s/%s", LOG_DIR, depnames[i],
 			REQUIRED_BY_FNAME);
 		if (strcmp(p->name, depnames[i]) != 0)
 		    warnx("warning: package '%s' requires '%s', but '%s' "
Index: create/create.h
===================================================================
RCS file: /home/ncvs/src/usr.sbin/pkg_install/create/create.h,v
retrieving revision 1.24
diff -u -I$Id.*$ -I$.+BSD.*$ -r1.24 create.h
--- create/create.h	29 Jun 2004 19:06:41 -0000	1.24
+++ create/create.h	11 Jul 2004 00:56:02 -0000
@@ -23,6 +23,9 @@
 #ifndef _INST_CREATE_H_INCLUDE
 #define _INST_CREATE_H_INCLUDE
 
+#define	BZIP2_VNAME	"BZIP2"
+#define	GZIP_VNAME	"GZIP"
+
 extern char	*Prefix;
 extern char	*Comment;
 extern char	*Desc;
Index: create/perform.c
===================================================================
RCS file: /home/ncvs/src/usr.sbin/pkg_install/create/perform.c,v
retrieving revision 1.78
diff -u -I$Id.*$ -I$.+BSD.*$ -r1.78 perform.c
--- create/perform.c	29 Jun 2004 18:56:59 -0000	1.78
+++ create/perform.c	11 Jul 2004 01:13:41 -0000
@@ -57,27 +57,27 @@
     /* chop suffix off if already specified, remembering if we want to compress  */
     len = strlen(pkg);
     if (len > 4) {
-	if (!strcmp(&pkg[len - 4], ".tbz")) {
+	if (!strcmp(&pkg[len - 4], BZIP2_SUFX)) {
 	    Zipper = BZIP2;
 	    pkg[len - 4] = '\0';
 	}
-	else if (!strcmp(&pkg[len - 4], ".tgz")) {
+	else if (!strcmp(&pkg[len - 4], GZIP_SUFX)) {
 	    Zipper = GZIP;
 	    pkg[len - 4] = '\0';
 	}
-	else if (!strcmp(&pkg[len - 4], ".tar")) {
+	else if (!strcmp(&pkg[len - 4], TAR_SUFX)) {
 	    Zipper = NONE;
 	    pkg[len - 4] = '\0';
 	}
     }
     if (Zipper == BZIP2) {
-	suf = "tbz";
-	setenv("BZIP2", "--best", 0);
+	suf = &BZIP2_SUFX[1];
+	setenv(BZIP2_VNAME, "--best", 0);
     } else if (Zipper == GZIP) {
-	suf = "tgz";
-	setenv("GZIP", "-9", 0);
+	suf = &GZIP_SUFX[1];
+	setenv(GZIP_VNAME, "-9", 0);
     } else
-	suf = "tar";
+	suf = &TAR_SUFX[1];
 
     if (InstalledPkg != NULL)
 	return (create_from_installed(pkg, suf));
@@ -359,7 +359,7 @@
 	dup2(pipefds[0], 0);
 	close(pipefds[0]);
 	close(pipefds[1]);
-	execv("/usr/bin/tar", (char * const *)(uintptr_t)args);
+	execv(_PATH_TAR, (char * const *)(uintptr_t)args);
 	cleanup(0);
 	errx(2, "%s: failed to execute tar command", __func__);
     }
Index: create/pl.c
===================================================================
RCS file: /home/ncvs/src/usr.sbin/pkg_install/create/pl.c,v
retrieving revision 1.27
diff -u -I$Id.*$ -I$.+BSD.*$ -r1.27 pl.c
--- create/pl.c	29 Jun 2004 19:06:41 -0000	1.27
+++ create/pl.c	11 Jul 2004 01:24:33 -0000
@@ -103,25 +103,24 @@
 	/* try making the container directory */
 	char *cp = strrchr(to, '/');
 	if (cp)
-	    vsystem("/bin/mkdir -p %.*s", cp - to,
-		    to);
+	    vsystem("%s -p %.*s", _PATH_MKDIR, cp - to, to);
 	return link(from, to);
     }
     return -1;
 }
 
-#define STARTSTRING "/usr/bin/tar cf -"
-#define TOOBIG(str) (int)strlen(str) + 6 + (int)strlen(home) + where_count > maxargs
+#define STARTSTRING _PATH_TAR " -cf -"
+#define TOOBIG(str) (int)strlen(str) + 7 + (int)strlen(home) + where_count > maxargs
 #define PUSHOUT() /* push out string */ \
 	if (where_count > (int)sizeof(STARTSTRING)-1) { \
-		    strcat(where_args, "|/usr/bin/tar xpf -"); \
+		    strcat(where_args, "|" _PATH_TAR " -xpf -"); /* safe */ \
 		    if (system(where_args)) { \
 			cleanup(0); \
 			errx(2, "%s: can't invoke tar pipeline", __func__); \
 		    } \
 		    memset(where_args, 0, maxargs); \
  		    last_chdir = NULL; \
-		    strcpy(where_args, STARTSTRING); \
+		    strcpy(where_args, STARTSTRING);	/* safe */ \
 		    where_count = sizeof(STARTSTRING)-1; \
 	}
 
@@ -153,7 +152,7 @@
     }
 
     memset(where_args, 0, maxargs);
-    strcpy(where_args, STARTSTRING);
+    strcpy(where_args, STARTSTRING);	/* safe */
     where_count = sizeof(STARTSTRING)-1;
     last_chdir = 0;
 
@@ -178,7 +177,7 @@
 
 
 	    /* First, look for it in the "home" dir */
-	    sprintf(fn, "%s/%s", home, p->name);
+	    snprintf(fn, FILENAME_MAX, "%s/%s", home, p->name);
 	    if (fexists(fn)) {
 		if (lstat(fn, &stb) == 0 && stb.st_dev == curdir &&
 		    S_ISREG(stb.st_mode)) {
Index: delete/perform.c
===================================================================
RCS file: /home/ncvs/src/usr.sbin/pkg_install/delete/perform.c,v
retrieving revision 1.41
diff -u -I$Id.*$ -I$.+BSD.*$ -r1.41 perform.c
--- delete/perform.c	29 Jun 2004 19:06:41 -0000	1.41
+++ delete/perform.c	11 Jul 2004 02:09:52 -0000
@@ -99,7 +99,7 @@
 			err_cnt++;
 			continue;
 		    }
-		    strcpy(*rbtmp, rb_entry->pkgname);
+		    strcpy(*rbtmp, rb_entry->pkgname);	/* safe */
 		    rbtmp++;
 		}
 		*rbtmp = NULL;
@@ -142,7 +142,7 @@
     if (Plist.head)
 	free_plist(&Plist);
 
-    sprintf(LogDir, "%s/%s", LOG_DIR, pkg);
+    snprintf(LogDir, FILENAME_MAX, "%s/%s", LOG_DIR, pkg);
 
     isinstalled = isinstalledpkg(pkg);
     if (isinstalled == 0) {
@@ -224,8 +224,8 @@
     if (fexists(REQUIRE_FNAME)) {
 	if (Verbose)
 	    printf("Executing 'require' script.\n");
-	vsystem("/bin/chmod +x %s", REQUIRE_FNAME);	/* be sure */
-	if (vsystem("./%s %s DEINSTALL", REQUIRE_FNAME, pkg)) {
+	vsystem("%s +x %s", _PATH_CHMOD, REQUIRE_FNAME);	/* be sure */
+	if (vsystem("./%s %s %s", REQUIRE_FNAME, pkg, PRE_DEINSTALL_ARG)) {
 	    warnx("package %s fails requirements %s", pkg,
 		   Force ? "" : "- not deleted");
 	    if (!Force)
@@ -244,8 +244,8 @@
 	pre_arg = post_arg = "";
     } else if (fexists(DEINSTALL_FNAME)) {
 	post_script = DEINSTALL_FNAME;
-	pre_arg = "DEINSTALL";
-	post_arg = "POST-DEINSTALL";
+	pre_arg = PRE_DEINSTALL_ARG;
+	post_arg = POST_DEINSTALL_ARG;
     } else {
 	post_script = pre_arg = post_arg = NULL;
     }
@@ -254,7 +254,7 @@
 	if (Fake)
 	    printf("Would execute de-install script at this point.\n");
 	else {
-	    vsystem("/bin/chmod +x %s", pre_script);	/* make sure */
+	    vsystem("%s +x %s", _PATH_CHMOD, pre_script);	/* make sure */
 	    if (vsystem("./%s %s %s", pre_script, pkg, pre_arg)) {
 		warnx("deinstall script returned error status");
 		if (!Force)
@@ -311,7 +311,7 @@
  	if (Fake)
  	    printf("Would execute post-deinstall script at this point.\n");
  	else {
- 	    vsystem("/bin/chmod +x %s", post_script);	/* make sure */
+ 	    vsystem("%s +x %s", _PATH_CHMOD, post_script);	/* make sure */
  	    if (vsystem("./%s %s %s", post_script, pkg, post_arg)) {
  		warnx("post-deinstall script returned error status");
  		if (!Force)
Index: info/perform.c
===================================================================
RCS file: /home/ncvs/src/usr.sbin/pkg_install/info/perform.c,v
retrieving revision 1.53
diff -u -I$Id.*$ -I$.+BSD.*$ -r1.53 perform.c
--- info/perform.c	29 Jun 2004 18:59:18 -0000	1.53
+++ info/perform.c	11 Jul 2004 00:47:32 -0000
@@ -101,7 +101,7 @@
 
     if (isURL(pkg)) {
 	if ((cp = fileGetURL(NULL, pkg)) != NULL) {
-	    strcpy(fname, cp);
+	    strlcpy(fname, cp, FILENAME_MAX);
 	    isTMP = TRUE;
 	}
     }
@@ -115,7 +115,7 @@
 	    snprintf(&fname[len], FILENAME_MAX - len, "/%s", pkg);
 	}
 	else
-	    strcpy(fname, pkg);
+	    strlcpy(fname, pkg, FILENAME_MAX);
 	cp = fname;
     }
     else {
@@ -151,7 +151,7 @@
 	    warnx("can't find package '%s' installed or in a file!", pkg);
 	    return 1;
 	}
-	sprintf(log_dir, "%s/%s", LOG_DIR, pkg);
+	snprintf(log_dir, FILENAME_MAX, "%s/%s", LOG_DIR, pkg);
 	if (chdir(log_dir) == FAIL) {
 	    warnx("can't change directory to '%s'!", log_dir);
 	    return 1;
@@ -272,16 +272,16 @@
 	free(cwd);    
 
     while ((tmp = strstr(resolved_path, "//")) != NULL)
-	strcpy(tmp, tmp + 1);
+	strcpy(tmp, tmp + 1);	/* safe */
  
     while ((tmp = strstr(resolved_path, "/./")) != NULL)
-	strcpy(tmp, tmp + 2);
+	strcpy(tmp, tmp + 2);	/* safe */
  
     while ((tmp = strstr(resolved_path, "/../")) != NULL) {
 	*tmp = '\0';
 	if ((tmp1 = strrchr(resolved_path, '/')) == NULL)
 	   tmp1 = resolved_path;
-	strcpy(tmp1, tmp + 3);
+	strcpy(tmp1, tmp + 3);	/* safe */
     }
 
     len = strlen(resolved_path);
@@ -340,7 +340,7 @@
 	/* If it's not a file, we'll see if it's an executable. */
 	if (isfile(wp->file) == FALSE) {
 	    if (strchr(wp->file, '/') == NULL) {
-		tmp = vpipe("/usr/bin/which %s", wp->file);
+		tmp = vpipe("%s %s", _PATH_WHICH, wp->file);
 		if (tmp != NULL) {
 		    strlcpy(wp->file, tmp, PATH_MAX);
 		    wp->skip = FALSE;
Index: lib/file.c
===================================================================
RCS file: /home/ncvs/src/usr.sbin/pkg_install/lib/file.c,v
retrieving revision 1.67
diff -u -I$Id.*$ -I$.+BSD.*$ -r1.67 file.c
--- lib/file.c	29 Jun 2004 19:06:42 -0000	1.67
+++ lib/file.c	11 Jul 2004 01:58:06 -0000
@@ -137,15 +137,15 @@
 {
     static char tmp[FILENAME_MAX];
     char *cp;
-    const char *suffixes[] = {".tbz", ".tgz", ".tar", NULL};
+    const char *suffixes[] = {BZIP2_SUFX, GZIP_SUFX, TAR_SUFX, NULL};
     int i;
 
     if (fexists(fname) && isfile(fname)) {
-	strcpy(tmp, fname);
+	strlcpy(tmp, fname, FILENAME_MAX);
 	return tmp;
     }
     if (base) {
-	strcpy(tmp, base);
+	strlcpy(tmp, base, FILENAME_MAX);
 
 	cp = strrchr(tmp, '/');
 	if (cp) {
@@ -155,15 +155,15 @@
 	if (cp)
 	    for (i = 0; suffixes[i] != NULL; i++) {
 		*(cp + 1) = '\0';
-		strcat(cp, "All/");
-		strcat(cp, fname);
-		strcat(cp, suffixes[i]);
+		strlcat(cp, "All/", FILENAME_MAX);
+		strlcat(cp, fname, FILENAME_MAX);
+		strlcat(cp, suffixes[i], FILENAME_MAX);
 		if (fexists(tmp))
 		    return tmp;
 	    }
     }
 
-    cp = getenv("PKG_PATH");
+    cp = getenv(PKG_PATH_VNAME);
     while (cp) {
 	char *cp2 = strsep(&cp, ":");
 
@@ -269,9 +269,9 @@
     char cmd[FILENAME_MAX];
 
     if (fname[0] == '/')
-	snprintf(cmd, FILENAME_MAX, "/bin/cp -r %s %s", fname, to);
+	snprintf(cmd, FILENAME_MAX, "%s -r %s %s", _PATH_CP, fname, to);
     else
-	snprintf(cmd, FILENAME_MAX, "/bin/cp -r %s/%s %s", dir, fname, to);
+	snprintf(cmd, FILENAME_MAX, "%s -r %s/%s %s", _PATH_CP, dir, fname, to);
     if (vsystem(cmd)) {
 	cleanup(0);
 	errx(2, "%s: could not perform '%s'", __func__, cmd);
@@ -284,9 +284,9 @@
     char cmd[FILENAME_MAX];
 
     if (fname[0] == '/')
-	snprintf(cmd, FILENAME_MAX, "/bin/mv %s %s", fname, to);
+	snprintf(cmd, FILENAME_MAX, "%s %s %s", _PATH_MV, fname, to);
     else
-	snprintf(cmd, FILENAME_MAX, "/bin/mv %s/%s %s", dir, fname, to);
+	snprintf(cmd, FILENAME_MAX, "%s %s/%s %s", _PATH_MV, dir, fname, to);
     if (vsystem(cmd)) {
 	cleanup(0);
 	errx(2, "%s: could not perform '%s'", __func__, cmd);
@@ -310,12 +310,12 @@
 	/* If absolute path, use it */
 	if (*fname == '/')
 	    dir = "/";
-	snprintf(cmd, FILENAME_MAX * 3, "/usr/bin/tar cf - -C %s %s | /usr/bin/tar xpf -",
-		 dir, fname);
+	snprintf(cmd, FILENAME_MAX * 3, "%s -cf - -C %s %s | %s -xpf -",
+		 _PATH_TAR, dir, fname, _PATH_TAR);
     }
     else
-	snprintf(cmd, FILENAME_MAX * 3, "/usr/bin/tar cf - %s | /usr/bin/tar xpf - -C %s",
-		 fname, dir);
+	snprintf(cmd, FILENAME_MAX * 3, "%s -cf - %s | %s -xpf - -C %s",
+		 _PATH_TAR, fname, _PATH_TAR, dir);
 #ifdef DEBUG
     printf("Using '%s' to copy trees.\n", cmd);
 #endif
@@ -340,22 +340,19 @@
     if (strcmp(pkg, "-")) {
 	cp = strrchr(pkg, '.');
 	if (cp) {
-	    strcpy(suff, cp + 1);
+	    strlcpy(suff, cp + 1, sizeof(suff));
 	    if (strchr(suff, 'z') || strchr(suff, 'Z')) {
 		if (strchr(suff, 'b'))
-		    comp = "-j";
+		    comp = BZIP2_TAR_OPT;
 		else
-		    comp = "-z";
+		    comp = GZIP_TAR_OPT;
 	    }
 	}
     }
     else
-#if defined(__FreeBSD_version) && __FreeBSD_version >= 500039
-	comp = "-j";
-#else
-	comp = "-z";
-#endif
-    if (vsystem("/usr/bin/tar -xp %s -f '%s' %s", comp, pkg, flist ? flist : "")) {
+	comp = PKG_TAR_OPT;
+    if (vsystem("%s -xp %s -f '%s' %s", _PATH_TAR, comp, pkg,
+        flist ? flist : "")) {
 	warnx("tar extract of %s failed!", pkg);
 	return 1;
     }
Index: lib/lib.h
===================================================================
RCS file: /home/ncvs/src/usr.sbin/pkg_install/lib/lib.h,v
retrieving revision 1.53
diff -u -I$Id.*$ -I$.+BSD.*$ -r1.53 lib.h
--- lib/lib.h	29 Jun 2004 19:06:42 -0000	1.53
+++ lib/lib.h	11 Jul 2004 02:05:47 -0000
@@ -30,12 +30,15 @@
 #include <sys/queue.h>
 #include <ctype.h>
 #include <dirent.h>
+#include <paths.h>
 #include <stdarg.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <unistd.h>
 
+#include "pathnames.h"
+
 /* Macros */
 #define SUCCESS	(0)
 #define	FAIL	(-1)
@@ -52,13 +55,13 @@
 #define NO		1
 
 /* Usually "rm", but often "echo" during debugging! */
-#define REMOVE_CMD	"/bin/rm"
+#define REMOVE_CMD	_PATH_RM
 
 /* Usually "rm", but often "echo" during debugging! */
-#define RMDIR_CMD	"/bin/rmdir"
+#define RMDIR_CMD	_PATH_RMDIR
 
 /* Where we put logging information by default, else ${PKG_DBDIR} if set */
-#define DEF_LOG_DIR	"/var/db/pkg"
+#define DEF_LOG_DIR	_PATH_VARDBPKG
 /* just in case we change the environment variable name */
 #define PKG_DBDIR	"PKG_DBDIR"
 /* macro to get name of directory where we put logging information */
@@ -77,6 +80,12 @@
 #define DISPLAY_FNAME		"+DISPLAY"
 #define MTREE_FNAME		"+MTREE_DIRS"
 
+/* *INSTALL argument names */
+#define	PRE_INSTALL_ARG		"PRE-INSTALL"
+#define	POST_INSTALL_ARG	"POST-INSTALL"
+#define	PRE_DEINSTALL_ARG	"DEINSTALL"
+#define	POST_DEINSTALL_ARG	"POST-DEINSTALL"
+
 #if defined(__FreeBSD_version) && __FreeBSD_version >= 500036
 #define INDEX_FNAME		"INDEX-5"
 #else
@@ -87,6 +96,25 @@
 
 /* The name of the "prefix" environment variable given to scripts */
 #define PKG_PREFIX_VNAME	"PKG_PREFIX"
+/* The name of the some other environment variables */
+#define PKG_PATH_VNAME		"PKG_PATH"
+#define PKG_TMPDIR_VNAME	"PKG_TMPDIR"
+#define PKG_NOWRAP_VNAME	"PKG_NOWRAP"
+#define PKG_ADDBASE_VNAME	"PKG_ADD_BASE"
+
+/* package suffixes */
+#define	TAR_SUFX	".tar"
+#define	GZIP_SUFX	".tgz"
+#define	BZIP2_SUFX	".tbz"
+#define	GZIP_TAR_OPT	"-z"
+#define	BZIP2_TAR_OPT	"-j"
+#if defined(__FreeBSD_version) && __FreeBSD_version >= 500039
+#define	PKG_SUFX	BZIP2_SUFX
+#define	PKG_TAR_OPT	BZIP2_TAR_OPT
+#else
+#define	PKG_SUFX	GZIP_SUFX
+#define	PKG_TAR_OPT	GZIP_TAR_OPT
+#endif
 
 /*
  * Version of the package tools - increase only when some
@@ -94,7 +122,7 @@
  */
 #define PKG_INSTALL_VERSION	20040629
 
-#define PKG_WRAPCONF_FNAME	"/var/db/pkg_install.conf"
+#define PKG_WRAPCONF_FNAME	_PATH_VARDB "pkg_install.conf"
 #define main(argc, argv)	real_main(argc, argv)
 
 /* Version numbers to assist with changes in package file format */
Index: lib/msg.c
===================================================================
RCS file: /home/ncvs/src/usr.sbin/pkg_install/lib/msg.c,v
retrieving revision 1.16
diff -u -I$Id.*$ -I$.+BSD.*$ -r1.16 msg.c
--- lib/msg.c	1 Apr 2002 09:39:07 -0000	1.16
+++ lib/msg.c	11 Jul 2004 01:58:33 -0000
@@ -23,7 +23,6 @@
 
 #include "lib.h"
 #include <err.h>
-#include <paths.h>
 
 /* Die a relatively simple death */
 void
Index: lib/pen.c
===================================================================
RCS file: /home/ncvs/src/usr.sbin/pkg_install/lib/pen.c,v
retrieving revision 1.41
diff -u -I$Id.*$ -I$.+BSD.*$ -r1.41 pen.c
--- lib/pen.c	29 Jun 2004 19:06:42 -0000	1.41
+++ lib/pen.c	11 Jul 2004 01:58:35 -0000
@@ -47,22 +47,22 @@
 
     if (pen[0] && isdir(dirname(pen)) == TRUE && (min_free(dirname(pen)) >= sz))
 	return pen;
-    else if ((cp = getenv("PKG_TMPDIR")) != NULL && stat(cp, &sb) != FAIL && (min_free(cp) >= sz))
-	sprintf(pen, "%s/instmp.XXXXXX", cp);
+    else if ((cp = getenv(PKG_TMPDIR_VNAME)) != NULL && stat(cp, &sb) != FAIL && (min_free(cp) >= sz))
+	snprintf(pen, FILENAME_MAX, "%s/instmp.XXXXXX", cp);
     else if ((cp = getenv("TMPDIR")) != NULL && stat(cp, &sb) != FAIL && (min_free(cp) >= sz))
-	sprintf(pen, "%s/instmp.XXXXXX", cp);
-    else if (stat("/var/tmp", &sb) != FAIL && min_free("/var/tmp") >= sz)
-	strcpy(pen, "/var/tmp/instmp.XXXXXX");
-    else if (stat("/tmp", &sb) != FAIL && min_free("/tmp") >= sz)
-	strcpy(pen, "/tmp/instmp.XXXXXX");
-    else if ((stat("/usr/tmp", &sb) == SUCCESS || mkdir("/usr/tmp", 01777) == SUCCESS) && min_free("/usr/tmp") >= sz)
-	strcpy(pen, "/usr/tmp/instmp.XXXXXX");
+	snprintf(pen, FILENAME_MAX, "%s/instmp.XXXXXX", cp);
+    else if (stat(_PATH_VARTMP, &sb) != FAIL && min_free(_PATH_VARTMP) >= sz)
+	strlcpy(pen, _PATH_VARTMP "instmp.XXXXXX", FILENAME_MAX);
+    else if (stat(_PATH_TMP, &sb) != FAIL && min_free(_PATH_TMP) >= sz)
+	strlcpy(pen, _PATH_TMP "instmp.XXXXXX", FILENAME_MAX);
+    else if ((stat(_PATH_USRTMP, &sb) == SUCCESS || mkdir(_PATH_USRTMP, 01777) == SUCCESS) && min_free(_PATH_USRTMP) >= sz)
+	strlcpy(pen, _PATH_USRTMP "instmp.XXXXXX", FILENAME_MAX);
     else {
 	cleanup(0);
 	errx(2,
 "%s: can't find enough temporary space to extract the files, please set your\n"
-"PKG_TMPDIR environment variable to a location with at least %ld bytes\n"
-"free", __func__, (long)sz);
+"%s environment variable to a location with at least %ld bytes\n"
+"free", __func__, PKG_TMPDIR_VNAME, (long)sz);
 	return NULL;
     }
     return pen;
@@ -87,7 +87,7 @@
 	pen[0] = '\0';
 	return;
     }
-    strcpy(pen, pstack[pdepth]);
+    strlcpy(pen, pstack[pdepth], FILENAME_MAX);
     free(pstack[pdepth--]);
 }
     
@@ -119,8 +119,9 @@
 	rmdir(pen);
 	cleanup(0);
 	errx(2, "%s: not enough free space to create '%s'.\n"
-	     "Please set your PKG_TMPDIR environment variable to a location\n"
-	     "with more space and\ntry the command again", __func__, pen);
+	     "Please set your %s environment variable to a location\n"
+	     "with more space and\ntry the command again", __func__,
+	     PKG_TMPDIR_VNAME, pen);
     }
 
     if (!getcwd(Previous, FILENAME_MAX)) {
@@ -136,7 +137,7 @@
     if (PenLocation[0])
 	pushPen(PenLocation);
 
-    strcpy(PenLocation, pen);
+    strlcpy(PenLocation, pen, FILENAME_MAX);
     return Previous;
 }
 
@@ -156,7 +157,8 @@
 	Previous[0] = '\0';
     }
     if (PenLocation[0]) {
-	if (PenLocation[0] == '/' && vsystem("/bin/rm -rf %s", PenLocation))
+	if (PenLocation[0] == '/' && vsystem("%s -rf %s", REMOVE_CMD,
+	    PenLocation))
 	    warnx("couldn't remove temporary dir '%s'", PenLocation);
 	popPen(PenLocation);
     }
Index: lib/pkgwrap.c
===================================================================
RCS file: /home/ncvs/src/usr.sbin/pkg_install/lib/pkgwrap.c,v
retrieving revision 1.1
diff -u -I$Id.*$ -I$.+BSD.*$ -r1.1 pkgwrap.c
--- lib/pkgwrap.c	9 Sep 2002 19:43:30 -0000	1.1
+++ lib/pkgwrap.c	11 Jul 2004 00:10:33 -0000
@@ -38,7 +38,7 @@
     char buffer[FILENAME_MAX], *cp, *verstr;
     int len;
 
-    if (getenv("PKG_NOWRAP") != NULL)
+    if (getenv(PKG_NOWRAP_VNAME) != NULL)
 	goto nowrap;
     f = fopen(PKG_WRAPCONF_FNAME, "r");
     if (f == NULL)
@@ -80,10 +80,10 @@
 	cp++;
     strlcat(buffer, "/", sizeof(buffer));
     strlcat(buffer, cp, sizeof(buffer));
-    setenv("PKG_NOWRAP", "1", 1);
+    setenv(PKG_NOWRAP_VNAME, "1", 1);
     execve(buffer, argv, environ);
 
 nowrap:
-    unsetenv("PKG_NOWRAP");
+    unsetenv(PKG_NOWRAP_VNAME);
     return(real_main(argc, argv));
 }
Index: lib/plist.c
===================================================================
RCS file: /home/ncvs/src/usr.sbin/pkg_install/lib/plist.c,v
retrieving revision 1.47
diff -u -I$Id.*$ -I$.+BSD.*$ -r1.47 plist.c
--- lib/plist.c	17 Apr 2003 09:56:05 -0000	1.47
+++ lib/plist.c	11 Jul 2004 00:49:08 -0000
@@ -191,7 +191,7 @@
     char *cp;
     const char *sp;
 
-    strcpy(cmd, s);
+    strlcpy(cmd, s, sizeof(cmd));
     str_lowercase(cmd);
     cp = cmd;
     sp = s;
@@ -444,7 +444,7 @@
 
 	case PLIST_FILE:
 	    last_file = p->name;
-	    sprintf(tmp, "%s/%s", Where, p->name);
+	    snprintf(tmp, FILENAME_MAX, "%s/%s", Where, p->name);
 	    if (isdir(tmp) && fexists(tmp) && !issymlink(tmp)) {
 		warnx("cannot delete specified file '%s' - it is a directory!\n"
 	   "this packing list is incorrect - ignoring delete request", tmp);
@@ -500,7 +500,7 @@
 	    break;
 
 	case PLIST_DIR_RM:
-	    sprintf(tmp, "%s/%s", Where, p->name);
+	    snprintf(tmp, FILENAME_MAX, "%s/%s", Where, p->name);
 	    if (!isdir(tmp) && fexists(tmp)) {
 		warnx("cannot delete specified directory '%s' - it is a file!\n"
 	"this packing list is incorrect - ignoring delete request", tmp);
Index: lib/url.c
===================================================================
RCS file: /home/ncvs/src/usr.sbin/pkg_install/lib/url.c,v
retrieving revision 1.4
diff -u -I$Id.*$ -I$.+BSD.*$ -r1.4 url.c
--- lib/url.c	29 Jun 2004 19:06:42 -0000	1.4
+++ lib/url.c	11 Jul 2004 01:58:17 -0000
@@ -45,7 +45,7 @@
 
     rp = NULL;
     /* Special tip that sysinstall left for us */
-    hint = getenv("PKG_ADD_BASE");
+    hint = getenv(PKG_ADDBASE_VNAME);
     if (!isURL(spec)) {
 	if (!base && !hint)
 	    return NULL;
@@ -55,7 +55,7 @@
 	 * handed as a dependency.
 	 */
 	if (base) {
-	    strcpy(fname, base);
+	    strlcpy(fname, base, FILENAME_MAX);
 	    /*
 	     * Advance back two slashes to get to the root of the package
 	     * hierarchy
@@ -67,13 +67,9 @@
 	    }
 	    if (cp) {
 		*(cp + 1) = '\0';
-		strcat(cp, "All/");
-		strcat(cp, spec);
-#if defined(__FreeBSD_version) && __FreeBSD_version >= 500039
-		strcat(cp, ".tbz");
-#else
-		strcat(cp, ".tgz");
-#endif
+		strlcat(cp, "All/", FILENAME_MAX);
+		strlcat(cp, spec, FILENAME_MAX);
+		strlcat(cp, PKG_SUFX, FILENAME_MAX);
 	    }
 	    else
 		return NULL;
@@ -83,13 +79,9 @@
 	     * Otherwise, we've been given an environment variable hinting
 	     * at the right location from sysinstall
 	     */
-	    strcpy(fname, hint);
-	    strcat(fname, spec);
-#if defined(__FreeBSD_version) && __FreeBSD_version >= 500039
-	    strcat(fname, ".tbz");
-#else
-	    strcat(fname, ".tgz");
-#endif
+	    strlcpy(fname, hint, FILENAME_MAX);
+	    strlcat(fname, spec, FILENAME_MAX);
+	    strlcat(fname, PKG_SUFX, FILENAME_MAX);
 	}
     }
     else
@@ -123,12 +115,7 @@
 	dup2(pfd[0], 0);
 	for (fd = getdtablesize() - 1; fd >= 3; --fd)
 	    close(fd);
-	execl("/usr/bin/tar", "tar",
-#if defined(__FreeBSD_version) && __FreeBSD_version >= 500039
-	    Verbose ? "-xjvf" : "-xjf",
-#else
-	    Verbose ? "-xzvf" : "-xzf",
-#endif
+	execl(_PATH_TAR, "tar", Verbose ? "-xv" : "-x", PKG_TAR_OPT, "-f",
 	    "-", (char *)0);
 	_exit(2);
     }
Index: sign/extern.h
===================================================================
RCS file: /home/ncvs/src/usr.sbin/pkg_install/sign/extern.h,v
retrieving revision 1.2
diff -u -I$Id.*$ -I$.+BSD.*$ -r1.2 extern.h
--- sign/extern.h	17 May 2001 10:12:45 -0000	1.2
+++ sign/extern.h	11 Jul 2004 00:07:53 -0000
@@ -70,7 +70,7 @@
 
 #define MAXID	512
 /* sha1.c */
-#define SHA1_DB_NAME	"/var/db/pkg/SHA1"
+#define SHA1_DB_NAME	_PATH_VARDBPKG "/SHA1"
 
 extern void *new_sha1_checker __P((struct mygzip_header *h, \
 	struct signature *sign, const char *userid, char *envp[], \
@@ -85,7 +85,7 @@
 	struct signature **sign, const char *userid));
 
 /* x509.c */
-#define X509_DB_NAME	"/var/db/pkg/X509"
+#define X509_DB_NAME	_PATH_VARDBPKG "/X509"
 
 extern void *new_x509_checker __P((struct mygzip_header *h, \
 	struct signature *sign, const char *userid, char *envp[], \
Index: sign/pgp.h
===================================================================
RCS file: /home/ncvs/src/usr.sbin/pkg_install/sign/pgp.h,v
retrieving revision 1.1
diff -u -I$Id.*$ -I$.+BSD.*$ -r1.1 pgp.h
--- sign/pgp.h	6 Feb 2001 06:46:42 -0000	1.1
+++ sign/pgp.h	11 Jul 2004 00:36:53 -0000
@@ -4,8 +4,9 @@
 #define MAXPGPSIGNSIZE	1024
 
 #ifndef PGP
-#define PGP "/usr/local/bin/pgp"
+#define PGP _PATH_PGP
 #endif
+#define	PGPPASSFD_VNAME	"PGPPASSFD"
 
 struct mygzip_header;
 struct signature;
Index: sign/pgp_check.c
===================================================================
RCS file: /home/ncvs/src/usr.sbin/pkg_install/sign/pgp_check.c,v
retrieving revision 1.2
diff -u -I$Id.*$ -I$.+BSD.*$ -r1.2 pgp_check.c
--- sign/pgp_check.c	1 Apr 2002 09:39:07 -0000	1.2
+++ sign/pgp_check.c	11 Jul 2004 01:58:40 -0000
@@ -36,18 +36,14 @@
 #include <assert.h>
 #include <unistd.h>
 #include <fcntl.h>
-#include <paths.h>
 #include <stdlib.h>
 #include <sys/stat.h>
+#include "lib.h"
 #include "stand.h"
 #include "pgp.h"
 #include "gzip.h"
 #include "extern.h"
 
-#ifndef _PATH_DEVNULL
-#define _PATH_DEVNULL	"/dev/null"
-#endif
-
 /* transform current process into pgp signature checker -u userid <fd */
 static void 
 pgpcheck(fd, userid, envp) 
Index: sign/pgp_sign.c
===================================================================
RCS file: /home/ncvs/src/usr.sbin/pkg_install/sign/pgp_sign.c,v
retrieving revision 1.5
diff -u -I$Id.*$ -I$.+BSD.*$ -r1.5 pgp_sign.c
--- sign/pgp_sign.c	29 Jun 2004 19:06:42 -0000	1.5
+++ sign/pgp_sign.c	11 Jul 2004 01:34:06 -0000
@@ -40,6 +40,7 @@
 #include <signal.h>
 #include <pwd.h>
 #include <assert.h>
+#include "lib.h"
 #include "stand.h"
 #include "pgp.h"
 #include "gzip.h"
@@ -272,9 +273,9 @@
 
 			sleep(1);
 			(void)close(fd[1]);
-			(void)sprintf(buf, "%d", fd[0]);
-			(void)setenv("PGPPASSFD", buf, 1);
-			printf("Parent process PGPPASSFD=%d.\n", fd[0]);
+			(void)snprintf(buf, sizeof(buf), "%d", fd[0]);
+			(void)setenv(PGPPASSFD_VNAME, buf, 1);
+			printf("Parent process %s=%d.\n", PGPPASSFD_VNAME, fd[0]);
 		}
 	}
 }
Index: sign/sha1.c
===================================================================
RCS file: /home/ncvs/src/usr.sbin/pkg_install/sign/sha1.c,v
retrieving revision 1.5
diff -u -I$Id.*$ -I$.+BSD.*$ -r1.5 sha1.c
--- sign/sha1.c	29 Jun 2004 19:06:42 -0000	1.5
+++ sign/sha1.c	11 Jul 2004 01:35:31 -0000
@@ -38,6 +38,7 @@
 #include <stdio.h>
 #include <assert.h>
 #include <sha.h>
+#include "lib.h"
 #include "stand.h"
 #include "gzip.h"
 #include "extern.h"
@@ -70,7 +71,7 @@
 	snprintf(result, BUFSIZE-2*SHA_DIGEST_LENGTH-1, SHA1_TEMPLATE, n->id);
 	length = strlen(result);
 	SHA1_End(&n->context, result + length);
-	strcat(result, "\n");
+	strcat(result, "\n");	/* safe */
 	free(n);	
 	return length;
 }
Index: sign/sign.c
===================================================================
RCS file: /home/ncvs/src/usr.sbin/pkg_install/sign/sign.c,v
retrieving revision 1.4
diff -u -I$Id.*$ -I$.+BSD.*$ -r1.4 sign.c
--- sign/sign.c	29 Jun 2004 19:06:42 -0000	1.4
+++ sign/sign.c	11 Jul 2004 00:38:39 -0000
@@ -104,6 +104,7 @@
 	int result;
 	struct signature *sign;
 	int success;
+	size_t len;
 
 	sign = NULL;
 	switch(type) {
@@ -123,13 +124,14 @@
 		free_signature(sign);
 		return 0;
 	}
-	copy = malloc(strlen(filename)+sizeof(COPY_TEMPLATE));
+	len = strlen(filename)+sizeof(COPY_TEMPLATE);
+	copy = malloc(len);
 	if (copy == NULL) {
 		fprintf(stderr, "Can't allocate memory\n");
 		free_signature(sign);
 		return 0;
 	}
-	sprintf(copy, COPY_TEMPLATE, filename);
+	snprintf(copy, len, COPY_TEMPLATE, filename);
 	result = embed_signature(filename, copy, sign);
 	if (result == 0) {
 		fprintf(stderr, "Can't embed signature in %s\n", filename);
Index: version/perform.c
===================================================================
RCS file: /home/ncvs/src/usr.sbin/pkg_install/version/perform.c,v
retrieving revision 1.10
diff -u -I$Id.*$ -I$.+BSD.*$ -r1.10 perform.c
--- version/perform.c	29 Jun 2004 19:06:42 -0000	1.10
+++ version/perform.c	11 Jul 2004 02:05:37 -0000
@@ -149,9 +149,9 @@
      */
     if (plist.origin != NULL) {
 	snprintf(tmp, PATH_MAX, "%s/%s", PORTS_DIR, plist.origin);
-	if (isdir(tmp) && chdir(tmp) != FAIL && isfile("Makefile")) {
-	    if ((latest = vpipe("/usr/bin/make -V PKGNAME", tmp)) == NULL)
-		warnx("Failed to get PKGNAME from %s/Makefile!", tmp);
+	if (isdir(tmp) && chdir(tmp) != FAIL && isfile(MAKEFILE_FNAME)) {
+	    if ((latest = vpipe("%s -V %s", _PATH_MAKE, tmp, PKG_NAME_VNAME)) == NULL)
+		warnx("Failed to get %s from %s/%s!", PKG_NAME_VNAME, tmp, MAKEFILE_FNAME);
 	    else
 		show_version(plist.name, latest, "port");
 	}
Index: version/version.h
===================================================================
RCS file: /home/ncvs/src/usr.sbin/pkg_install/version/version.h,v
retrieving revision 1.3
diff -u -I$Id.*$ -I$.+BSD.*$ -r1.3 version.h
--- version/version.h	29 Jun 2004 18:54:47 -0000	1.3
+++ version/version.h	11 Jul 2004 02:06:52 -0000
@@ -24,11 +24,13 @@
 #define _INST_VERSION_H_INCLUDE
 
 /* Where the ports lives by default */
-#define DEF_PORTS_DIR	"/usr/ports"
+#define DEF_PORTS_DIR	_PATH_USRPORTS
 /* just in case we change the environment variable name */
 #define PORTSDIR	"PORTSDIR"
 /* macro to get name of directory where we put logging information */
 #define PORTS_DIR	(getenv(PORTSDIR) ? getenv(PORTSDIR) : DEF_PORTS_DIR)
+#define	PKG_NAME_VNAME	"PKGNAME"
+#define	MAKEFILE_FNAME	"Makefile"
 
 struct index_entry {
     SLIST_ENTRY(index_entry) next;
>Release-Note:
>Audit-Trail:
>Unformatted:


More information about the freebsd-bugs mailing list