[INSTALLED 2/4] sed: fix unlikely mkostemp-related overflow

[Paul Eggert]

* bootstrap.conf (gnulib_modules): Add mempcpy.
* sed/utils.c (ck_mkstemp): Use mempcpy instead of sprintf,
which doesn’t work with strings longer than INT_MAX.
---
 bootstrap.conf | 1 +
 sed/utils.c    | 9 +++++++--
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/bootstrap.conf b/bootstrap.conf
index 9753f53..d491028 100644
--- a/bootstrap.conf
+++ b/bootstrap.conf
@@ -44,6 +44,7 @@ mbrlen
 mbrtowc
 mbsinit
 memchr
+mempcpy
 memrchr
 minmax
 mkostemp
diff --git a/sed/utils.c b/sed/utils.c
index 03243c2..19d6554 100644
--- a/sed/utils.c
+++ b/sed/utils.c
@@ -185,8 +185,13 @@ FILE *
 ck_mkstemp (char **p_filename, const char *tmpdir,
             const char *base, const char *mode)
 {
-  char *template = xmalloc (strlen (tmpdir) + strlen (base) + 8);
-  sprintf (template, "%s/%sXXXXXX", tmpdir, base);
+  idx_t tmpdirlen = strlen (tmpdir), baselen = strlen (base);
+  char *template = xmalloc (tmpdirlen + baselen + 8);
+  char *basecopy = mempcpy (template, tmpdir, tmpdirlen);
+  *basecopy++ = '/';
+  char *suffix = mempcpy (basecopy, base, baselen);
+  memset (suffix, 'X', 6);
+  suffix[6] = '\0';
 
    /* The ownership might change, so omit some permissions at first
       so unauthorized users cannot nip in before the file is ready.
-- 
2.38.1