Dont use strcat and other unsafe string ops

src/array.c

@@ -183,10 +183,10 @@ SDB_API int sdb_array_insert(Sdb *s, const char *key, int idx, const char *val,
 		ptr = (char *)Aindexof (nstr, idx);
 		if (ptr) {
 			int lptr = (nstr + lstr + 1) - ptr;
-			char *p_1 = ptr > nstr? ptr - 1: ptr;
-			*p_1 = 0;
-			lnstr = ptr - nstr - 1;
-			if (lnstr < 0) {
+			if (ptr > nstr) {
+				ptr[-1] = 0;
+				lnstr = ptr - nstr - 1;
+			} else {
 				lnstr = 0;
 			}
 			memcpy (x, nstr, lnstr);
@@ -282,13 +282,11 @@ SDB_API int sdb_array_add_sorted(Sdb *s, const char *key, const char *val, ut32
 	if (str_lp < str_e) {
 		memcpy (nstr_p, str_lp, str_e - str_lp);
 		nstr_p += str_e - str_lp;
-		*(nstr_p) = '\0';
+		*nstr_p = '\0';
+	} else if (nstr_p != nstr) {
+		*--nstr_p = '\0';
 	} else {
-		if (nstr_p > nstr) {
-			*(--nstr_p) = '\0';
-		} else {
-			*nstr_p = '\0';
-		}
+		*nstr_p = '\0';
 	}
 	sdb_set_owned (s, key, nstr, cas);
 	sdb_gh_free (vals);
@@ -361,7 +359,6 @@ SDB_API int sdb_array_set(Sdb *s, const char *key, int idx, const char *val,
 	}
 	// XXX: should we cache sdb_alen value inside kv?
 	len = sdb_alen (str);
-	lstr--;
 	if (idx < 0 || idx == len) { // append
 		return sdb_array_insert (s, key, -1, val, cas);
 	}
@@ -389,13 +386,15 @@ SDB_API int sdb_array_set(Sdb *s, const char *key, int idx, const char *val,
 			return false;
 		}
 		ptr = nstr + diff;
-		//memcpy (nstr, str, lstr+1);
 		memcpy (nstr, str, diff);
 		memcpy (ptr, val, lval + 1);
 		usr = Aindexof (str, idx + 1);
 		if (usr) {
+			size_t usr_len = (str + lstr + 1) - usr;
 			ptr[lval] = SDB_RS;
-			strcpy (ptr + lval + 1, usr);
+			memcpy (ptr + lval + 1, usr, usr_len);
+		} else {
+			nstr[diff + lval] = '\0';
 		}
 		int ret = sdb_set (s, key, nstr, cas);
 		sdb_gh_free (nstr);

src/json.c

@@ -150,15 +150,14 @@ SDB_API bool sdb_json_set(Sdb *s, const char *k, const char *p, const char *v, u
 		size_t buf_len = jslen + strlen (p) + strlen (v) + 7;
 		char *buf = (char *)sdb_gh_malloc (buf_len);
 		if (buf) {
-			int curlen, is_str = isstring (v);
+			int is_str = isstring (v);
 			const char *quote = is_str ? "\"" : "";
 			const char *comma = ""; // XX: or comma
 			if (js[0] && js[1] != '}') {
 				comma = ",";
 			}
-			curlen = snprintf (buf, buf_len, "{\"%s\":%s%s%s%s",
-				p, quote, v, quote, comma);
-			strcpy (buf + curlen, js + 1);
+			snprintf (buf, buf_len, "{\"%s\":%s%s%s%s%s",
+				p, quote, v, quote, comma, js + 1);
 			// transfer ownership
 			sdb_set_owned (s, k, buf, cas);
 			return true;

src/lock.c

@@ -4,16 +4,10 @@
 #include "sdb/sdb.h"
 
 SDB_API bool sdb_lock_file(const char *f, char *buf, size_t buf_size) {
-	size_t len;
 	if (!f || !*f || !buf || !buf_size) {
 		return false;
 	}
-	len = strlen (f);
-	if (len + 10 > buf_size) {
-		return false;
-	}
-	memcpy (buf, f, len);
-	strcpy (buf + len, ".lock");
+	snprintf (buf, buf_size, "%s.lock", f);
 	return true;
 }
 

src/query.c

@@ -213,7 +213,7 @@ SDB_API char *sdb_querys(Sdb *r, char *buf, size_t len, const char *_cmd) {
 next_quote:
 		quot = (char *)strchr (quot, '"');
 		if (quot) {
-			if (quot > val && *(quot - 1) == '\\') {
+			if (quot != val && *(quot - 1) == '\\') {
 				memmove (quot - 1, quot, strlen (quot) + 1);
 				goto next_quote;
 			}