potential problem fixed afer some reasoning

libmysql/libmysql.c

@@ -316,7 +316,7 @@ HANDLE create_named_pipe(NET *net, uint connect_timeout, char **arg_host,
 			 char **arg_unix_socket)
 {
   HANDLE hPipe=INVALID_HANDLE_VALUE;
-  char szPipeName [ 257 ];
+  char szPipeName [ 1024 ];
   DWORD dwMode;
   int i;
   my_bool testing_named_pipes=0;
@@ -327,9 +327,9 @@ HANDLE create_named_pipe(NET *net, uint connect_timeout, char **arg_host,
   if (!host || !strcmp(host,LOCAL_HOST))
     host=LOCAL_HOST_NAMEDPIPE;
 
-  sprintf( szPipeName, "\\\\%s\\pipe\\%s", host, unix_socket);
-  DBUG_PRINT("info",("Server name: '%s'.  Named Pipe: %s",
-		     host, unix_socket));
+  strxnmov(szPipeName, sizeof(szPipeName), "\\\\", host, "\\pipe\\",
+                                           unix_socket, NullS);
+  DBUG_PRINT("info",("Server name: '%s'.  Named Pipe: %s", host, unix_socket));
 
   for (i=0 ; i < 100 ; i++)			/* Don't retry forever */
   {
@@ -694,7 +694,7 @@ mysql_debug(const char *debug __attribute__((unused)))
 #else
     {
       char buff[80];
-      strmov(strmov(buff,"libmysql: "),env);
+      strxnmov(buff,sizeof(buff),"libmysql: ", env);
       MessageBox((HWND) 0,"Debugging variable MYSQL_DEBUG used",buff,MB_OK);
     }
 #endif
@@ -1746,7 +1746,7 @@ mysql_real_connect(MYSQL *mysql,const char *host, const char *user,
 	    (unix_socket && !strcmp(unix_socket,MYSQL_NAMEDPIPE)))
 	{
 	  net->last_errno= CR_SERVER_LOST;
-	  strmov(net->last_error,ER(net->last_errno));    
+	  strmov(net->last_error,ER(net->last_errno));
 	  goto error;		/* User only requested named pipes */
 	}
 	/* Try also with TCP/IP */
@@ -1832,7 +1832,7 @@ mysql_real_connect(MYSQL *mysql,const char *host, const char *user,
       vio_poll_read(net->vio, mysql->options.connect_timeout))
   {
     net->last_errno= CR_SERVER_LOST;
-    strmov(net->last_error,ER(net->last_errno));    
+    strmov(net->last_error,ER(net->last_errno));
     goto error;
   }
   if ((pkt_length=net_safe_read(mysql)) == packet_error)
@@ -1984,7 +1984,7 @@ mysql_real_connect(MYSQL *mysql,const char *host, const char *user,
     if (my_net_write(net,buff,(uint) (2)) || net_flush(net))
     {
       net->last_errno= CR_SERVER_LOST;
-      strmov(net->last_error,ER(net->last_errno));    
+      strmov(net->last_error,ER(net->last_errno));
       goto error;
     }
     /* Do the SSL layering. */
@@ -1996,7 +1996,7 @@ mysql_real_connect(MYSQL *mysql,const char *host, const char *user,
 				       options->ssl_cipher)))
     {
       net->last_errno= CR_SSL_CONNECTION_ERROR;
-      strmov(net->last_error,ER(net->last_errno));    
+      strmov(net->last_error,ER(net->last_errno));
       goto error;
     }
     DBUG_PRINT("info", ("IO layer change in progress..."));
@@ -2036,7 +2036,7 @@ mysql_real_connect(MYSQL *mysql,const char *host, const char *user,
   if (my_net_write(net,buff,(ulong) (end-buff)) || net_flush(net))
   {
     net->last_errno= CR_SERVER_LOST;
-    strmov(net->last_error,ER(net->last_errno));    
+    strmov(net->last_error,ER(net->last_errno));
     goto error;
   }
   if (net_safe_read(mysql) == packet_error)

libmysql/manager.c

@@ -133,7 +133,7 @@ MYSQL_MANAGER*  STDCALL mysql_manager_connect(MYSQL_MANAGER* con,
     if (!hp)
     {
       con->last_errno=tmp_errno;
-      sprintf(con->last_error,"Could not resolve host '%s'",host);
+      sprintf(con->last_error,"Could not resolve host '%-.64s'",host);
       my_gethostbyname_r_free();
       goto err;
     }

mysys/mf_tempfile.c

@@ -124,11 +124,11 @@ File create_temp_file(char *to, const char *dir, const char *prefix,
 #ifdef OS2
     /* changing environ variable doesn't work with VACPP */
     char  buffer[256];
-    sprintf( buffer, "TMP=%s", dir);
+    strxnmov(buffer, sizeof(buffer), "TMP=", dir);
     /* remove ending backslash */
     if (buffer[strlen(buffer)-1] == '\\')
        buffer[strlen(buffer)-1] = '\0';
-    putenv( buffer);
+    putenv(buffer);
 #elif !defined(__NETWARE__)
     old_env= (char**) environ;
     if (dir)
@@ -138,7 +138,7 @@ File create_temp_file(char *to, const char *dir, const char *prefix,
     }
 #endif
     if ((res=tempnam((char*) dir, (char*) prefix)))
-    {    
+    {
       strmake(to,res,FN_REFLEN-1);
       (*free)(res);
       file=my_create(to,0,

mysys/my_tempnam.c

@@ -106,7 +106,7 @@ my_string my_tempnam(const char *dir, const char *pfx,
 #ifdef OS2
   /* changing environ variable doesn't work with VACPP */
   char  buffer[256];
-  sprintf( buffer, "TMP=%s", dir);
+  strxnmov(buffer, sizeof(buffer), "TMP=", dir);
   /* remove ending backslash */
   if (buffer[strlen(buffer)-1] == '\\')
      buffer[strlen(buffer)-1] = '\0';

sql/log.cc

@@ -202,7 +202,7 @@ bool MYSQL_LOG::open(const char *log_name, enum_log_type log_type_arg,
     open_flags |= O_RDWR;
   else
     open_flags |= O_WRONLY;
-  
+
   db[0]=0;
   open_count++;
   if ((file=my_open(log_file_name,open_flags,
@@ -215,12 +215,15 @@ bool MYSQL_LOG::open(const char *log_name, enum_log_type log_type_arg,
   case LOG_NORMAL:
   {
     char *end;
+    int len=my_snprintf(buff, sizeof(buff),
 #ifdef __NT__
-    sprintf(buff, "%s, Version: %s, started with:\nTCP Port: %d, Named Pipe: %s\n", my_progname, server_version, mysql_port, mysql_unix_port);
+                        "%s, Version: %s, started with:\nTCP Port: %d, Named Pipe: %s\n",
 #else
-    sprintf(buff, "%s, Version: %s, started with:\nTcp port: %d  Unix socket: %s\n", my_progname,server_version,mysql_port,mysql_unix_port);
+                        "%s, Version: %s, started with:\nTcp port: %d  Unix socket: %s\n",
 #endif
-    end=strmov(strend(buff),"Time                 Id Command    Argument\n");
+                        my_progname, server_version, mysql_port, mysql_unix_port);
+    end=strnmov(buff+len,"Time                 Id Command    Argument\n",
+                sizeof(buff)-len);
     if (my_b_write(&log_file, (byte*) buff,(uint) (end-buff)) ||
 	flush_io_cache(&log_file))
       goto err;
@@ -231,7 +234,7 @@ bool MYSQL_LOG::open(const char *log_name, enum_log_type log_type_arg,
     time_t skr=time(NULL);
     struct tm tm_tmp;
     localtime_r(&skr,&tm_tmp);
-    sprintf(buff,"# %s, Version: %s at %02d%02d%02d %2d:%02d:%02d\n",
+    my_snprintf(buff,sizeof(buff),"# %s, Version: %s at %02d%02d%02d %2d:%02d:%02d\n",
 	    my_progname,server_version,
 	    tm_tmp.tm_year % 100,
 	    tm_tmp.tm_mon+1,
@@ -254,7 +257,7 @@ bool MYSQL_LOG::open(const char *log_name, enum_log_type log_type_arg,
       index_file_name_arg= name;	// Use same basename for index file
       opt= MY_UNPACK_FILENAME | MY_REPLACE_EXT;
     }
-  
+
     if (!my_b_filelength(&log_file))
     {
       /*

sql/mini_client.cc

@@ -117,7 +117,7 @@ HANDLE create_named_pipe(NET *net, uint connect_timeout, char **arg_host,
 			 char **arg_unix_socket)
 {
   HANDLE hPipe=INVALID_HANDLE_VALUE;
-  char szPipeName [ 257 ];
+  char szPipeName [512];
   DWORD dwMode;
   int i;
   my_bool testing_named_pipes=0;
@@ -126,7 +126,8 @@ HANDLE create_named_pipe(NET *net, uint connect_timeout, char **arg_host,
   if (!host || !strcmp(host,LOCAL_HOST))
     host=LOCAL_HOST_NAMEDPIPE;
 
-  sprintf( szPipeName, "\\\\%s\\pipe\\%s", host, unix_socket);
+  strxnmov(szPipeName, sizeof(szPipeName), "\\\\", host, "\\pipe\\",
+                                           unix_socket, NullS);
   DBUG_PRINT("info",("Server name: '%s'.  Named Pipe: %s",
 		     host, unix_socket));
 

sql/mysqld.cc

@@ -189,7 +189,7 @@ static const char* default_dbug_option=IF_WIN("d:t:i:O,\\mysqld.trace",
 #endif
 
 #ifdef __NT__
-static char szPipeName [ 257 ];
+static char szPipeName [512];
 static SECURITY_ATTRIBUTES saPipeSecurity;
 static SECURITY_DESCRIPTOR sdPipeDescriptor;
 static HANDLE hPipe = INVALID_HANDLE_VALUE;
@@ -1173,7 +1173,8 @@ static void server_init(void)
   if (Service.IsNT() && mysql_unix_port[0] && !opt_bootstrap &&
       opt_enable_named_pipe)
   {
-    sprintf( szPipeName, "\\\\.\\pipe\\%s", mysql_unix_port );
+    strxnmov(szPipeName, sizeof(szPipeName), "\\\\.\\pipe\\",
+                                             unix_socket, NullS);
     ZeroMemory( &saPipeSecurity, sizeof(saPipeSecurity) );
     ZeroMemory( &sdPipeDescriptor, sizeof(sdPipeDescriptor) );
     if ( !InitializeSecurityDescriptor(&sdPipeDescriptor,