Index: apps/app_rpt.c
===================================================================
RCS file: /usr/cvsroot/asterisk/apps/app_rpt.c,v
retrieving revision 1.15
diff -u -p -r1.15 app_rpt.c
--- apps/app_rpt.c	29 Jun 2004 04:43:20 -0000	1.15
+++ apps/app_rpt.c	13 Jul 2004 22:19:33 -0000
@@ -751,10 +751,10 @@ struct ast_channel *mychannel,*genchanne
 		if (mychannel->callerid) free(mychannel->callerid);
 		mychannel->callerid = strdup(myrpt->ourcallerid);
 	}
-	strcpy(mychannel->exten,myrpt->exten);
-	strcpy(mychannel->context,myrpt->ourcontext);
+	strncpy(mychannel->exten, myrpt->exten, sizeof(mychannel->exten) - 1);
+	strncpy(mychannel->context, myrpt->ourcontext, sizeof(mychannel->context) - 1);
 	if (myrpt->acctcode)
-		strcpy(mychannel->accountcode,myrpt->acctcode);
+		strncpy(mychannel->accountcode, myrpt->acctcode, sizeof(mychannel->accountcode) - 1);
 	mychannel->priority = 1;
 	ast_channel_undefer_dtmf(mychannel);
 	if (ast_pbx_start(mychannel) < 0)
@@ -809,11 +809,11 @@ struct ast_channel *mychannel,*genchanne
 
 static void send_link_dtmf(struct rpt *myrpt,char c)
 {
-char	str[300];
-struct	ast_frame wf;
-struct	rpt_link *l;
+	char	str[300] = "";
+	struct	ast_frame wf;
+	struct	rpt_link *l;
 
-	sprintf(str,"D %s %s %d %c",myrpt->cmdnode,myrpt->name,++(myrpt->dtmfidx),c);
+	snprintf(str, sizeof(str), "D %s %s %d %c",myrpt->cmdnode,myrpt->name,++(myrpt->dtmfidx),c);
 	wf.frametype = AST_FRAME_TEXT;
 	wf.subclass = 0;
 	wf.offset = 0;
@@ -846,10 +846,15 @@ struct	rpt_link *l;
 
 static void process_dtmf(char *cmd,struct rpt *myrpt, int allow_linkcmd)
 {
-pthread_attr_t attr;
-char *tele,tmp[300],deststr[300],*val,*s,*s1;
-struct rpt_link *l;
-ZT_CONFINFO ci;  /* conference info */
+	pthread_attr_t attr;
+	char *tele;
+	char tmp[300] = "";
+	char deststr[300] = "";
+	char *val;
+	char *s;
+	char *s1;
+	struct rpt_link *l;
+	ZT_CONFINFO ci;  /* conference info */
 
 	switch(atoi(cmd) / 1000)
 	{
@@ -980,7 +985,7 @@ ZT_CONFINFO ci;  /* conference info */
 		}
 		/* zero the silly thing */
 		memset((char *)l,0,sizeof(struct rpt_link));
-		sprintf(deststr,"IAX2/%s",s1);
+		snprintf(deststr, sizeof(deststr), "IAX2/%s", s1);
 		tele = strchr(deststr,'/');
 		if (!tele)
 		{
@@ -1081,7 +1086,7 @@ ZT_CONFINFO ci;  /* conference info */
 		l->mode = 1;
 		strncpy(l->name,cmd + 1,MAXNODESTR - 1);
 		l->isremote = (s && ast_true(s));
-		sprintf(deststr,"IAX2/%s",s1);
+		snprintf(deststr, sizeof(deststr), "IAX2/%s", s1);
 		tele = strchr(deststr,'/');
 		if (!tele)
 		{
@@ -1157,7 +1162,7 @@ ZT_CONFINFO ci;  /* conference info */
 		myrpt->dtmfbuf[0] = 0;
 		myrpt->rem_dtmfidx = -1;
 		myrpt->rem_dtmfbuf[0] = 0;
-		strcpy(myrpt->cmdnode,cmd + 1);
+		strncpy(myrpt->cmdnode, cmd + 1, sizeof(myrpt->cmdnode) - 1);
 		ast_mutex_unlock(&myrpt->lock);
 		rpt_telemetry(myrpt,REMGO,NULL);				
 		return;
@@ -1197,10 +1202,14 @@ ZT_CONFINFO ci;  /* conference info */
 static void handle_link_data(struct rpt *myrpt, struct rpt_link *mylink,
 	char *str)
 {
-char	tmp[300],cmd[300],dest[300],src[300],c;
-int	seq;
-struct rpt_link *l;
-struct	ast_frame wf;
+	char tmp[300];
+	char cmd[300] = "";
+	char dest[300];
+	char src[300];
+	char c;
+	int	seq;
+	struct rpt_link *l;
+	struct	ast_frame wf;
 
 	wf.frametype = AST_FRAME_TEXT;
 	wf.subclass = 0;
@@ -1318,7 +1327,7 @@ struct	ast_frame wf;
 		}
 		if (myrpt->rem_dtmfidx == FUNCTION_LEN)
 		{
-			strcpy(cmd,myrpt->rem_dtmfbuf);
+			strncpy(cmd, myrpt->rem_dtmfbuf, sizoef(cmd) - 1);
 			myrpt->rem_dtmfbuf[0] = 0;
 			myrpt->rem_dtmfidx = -1;
 			ast_mutex_unlock(&myrpt->lock);
@@ -1520,11 +1529,13 @@ static void rbi_out(struct rpt *myrpt,un
 
 static int setrbi(struct rpt *myrpt)
 {
-char tmp[MAXREMSTR],rbicmd[5],*s;
-int	band,txoffset = 0,txpower = 0,rxpl;
+	char tmp[MAXREMSTR] = "";
+	char rbicmd[5];
+	char *s;
+	int	band,txoffset = 0,txpower = 0,rxpl;
 
 	
-	strcpy(tmp,myrpt->freq);
+	strncpy(tmp, myrpt->freq, sizeof(tmp) - 1);
 	s = strchr(tmp,'.');
 	/* if no decimal, is invalid */
 	if (s == NULL) return -1;
@@ -1574,7 +1585,12 @@ int	band,txoffset = 0,txpower = 0,rxpl;
 
 static int remote_function(struct rpt *myrpt,char *cmd, struct ast_channel *mychannel)
 {
-char	*s,*s1,tmp[300],oc,savestr[MAXREMSTR],*val;
+	char *s;
+	char *s1;
+	char tmp[300] = "";
+	char oc;
+	char savestr[MAXREMSTR] = "";
+	char *val;
 
 	switch(cmd[0])
 	{
@@ -1592,8 +1608,8 @@ char	*s,*s1,tmp[300],oc,savestr[MAXREMST
 		s1 = strchr(s,',');
 		if (!s1) return 0;
 		*s1++ = 0;
-		strcpy(myrpt->freq,tmp);
-		strcpy(myrpt->rxpl,s);
+		strncpy(myrpt->freq, tmp, sizeof(myrpt->freq) - 1);
+		strncpy(myrpt->rxpl, s, sizeof(myrpt->rxpl) - 1);
 		myrpt->offset = REM_SIMPLEX;
 		myrpt->powerlevel = REM_MEDPWR;
 		myrpt->rxplon = 0;
@@ -1654,7 +1670,8 @@ char	*s,*s1,tmp[300],oc,savestr[MAXREMST
 			if (strlen(s) > 3) return 0;
 			if (strlen(s) < 3) memset(s + strlen(s),'0',3 - strlen(s));
 			s[3] = 0;
-		} else strcat(tmp,".000");
+		} else
+			strncat(tmp,".000", sizeof(tmp) - strlen(tmp) - 1);
 		if (oc)
 		{
 			switch(oc)
@@ -1673,11 +1690,11 @@ char	*s,*s1,tmp[300],oc,savestr[MAXREMST
 			} 
 		} else myrpt->offset = REM_SIMPLEX;
 		if(s) *--s = '.';
-		strcpy(savestr,myrpt->freq);
-		strcpy(myrpt->freq,tmp + 1);
+		strncpy(savestr, myrpt->freq, sizeof(savestr) - 1);
+		strncpy(myrpt->freq, tmp + 1, sizeof(myrpt->freq) - 1);
 		if (setrbi(myrpt) == -1)
 		{
-			strcpy(myrpt->freq,savestr);
+			strncpy(myrpt->freq, savestr, sizeof(myrpt->freq) - 1);
 			return 0;
 		}
 		break;
@@ -1689,12 +1706,13 @@ char	*s,*s1,tmp[300],oc,savestr[MAXREMST
 		{
 			*s++ = '.';
 			if (strlen(s + 1) > 1) return 0;
-		} else strcat(tmp,".0");
-		strcpy(savestr,myrpt->rxpl);
-		strcpy(myrpt->rxpl,tmp + 1);
+		} else
+			strncat(tmp, ".0", sizeof(tmp) - strlen(tmp) - 1);
+		strncpy(savestr, myrpt->rxpl, sizeof(savestr) - 1);
+		strncpy(myrpt->rxpl, tmp + 1, sizeof(myrpt->rxpl) - 1);
 		if (setrbi(myrpt) == -1)
 		{
-			strcpy(myrpt->rxpl,savestr);
+			strncpy(myrpt->rxpl, savestr, sizeof(myrpt->rxpl) - 1);
 			return 0;
 		}
 		break;
@@ -1736,15 +1754,17 @@ char	*s,*s1,tmp[300],oc,savestr[MAXREMST
 
 static int handle_dtmf_digit(struct rpt *myrpt,char c, struct ast_channel *mychannel)
 {
-char str[MAXDTMF],*s,*s1;
-time_t	now;
-int	res = 0;
+	char str[MAXDTMF] = "";
+	char *s;
+	char *s1;
+	time_t	now;
+	int	res = 0;
 
 	time(&now);
 	/* if timed-out */
 	if ((myrpt->dtmf_time_rem + DTMF_TIMEOUT) < now)
 	{
-		strcpy(str,myrpt->dtmfbuf);
+		strncpy(str, myrpt->dtmfbuf, sizeof(str) - 1);
 		myrpt->dtmfidx = -1;
 		myrpt->dtmfbuf[0] = 0;
 		myrpt->dtmf_time_rem = 0;
@@ -1891,7 +1911,7 @@ int	res = 0;
 		myrpt->dtmf_time_rem = 0;
 		return 0;
 	}
-	strcpy(str,myrpt->dtmfbuf);
+	strncpy(str, myrpt->dtmfbuf, sizeof(str) - 1);
 	myrpt->remotetx = 0;
 	ast_indicate(myrpt->txchannel,AST_CONTROL_RADIO_UNKEY);
 	if (!myrpt->remoterx)
@@ -2711,8 +2731,8 @@ int	i,n;
 		/* if is a remote, dont start one for it */
 		if (rpt_vars[i].remote)
 		{
-			strcpy(rpt_vars[i].freq,"146.460");
-			strcpy(rpt_vars[i].rxpl,"100.0");
+			strncpy(rpt_vars[i].freq, "146.460", sizeof(rpt_vars[i].freq) - 1);
+			strncpy(rpt_vars[i].rxpl, "100.0", sizeof(rpt_vars[i].rxpl) - 1);
 			rpt_vars[i].offset = REM_SIMPLEX;
 			rpt_vars[i].powerlevel = REM_MEDPWR;
 			continue;