add a length to string_sub() and add fstring_sub() and pstring_sub()

18 files changed, 122 insertions, 97 deletions

diff --git a/source/include/proto.h b/source/include/proto.h
index b8ab5fbc41d..5daaf177be8 100644
--- a/source/include/proto.h
+++ b/source/include/proto.h
@@ -386,8 +386,10 @@ BOOL in_list(char *s,char *list,BOOL casesensitive);
 BOOL string_init(char **dest,const char *src);
 void string_free(char **s);
 BOOL string_set(char **dest,const char *src);
-void string_sub(char *s,const char *pattern,const char *insert);
-void all_string_sub(char *s,const char *pattern,const char *insert);
+void string_sub(char *s,const char *pattern,const char *insert, size_t len);
+void fstring_sub(char *s,const char *pattern,const char *insert);
+void pstring_sub(char *s,const char *pattern,const char *insert);
+void all_string_sub(char *s,const char *pattern,const char *insert, size_t len);
 void split_at_last_component(char *path, char *front, char sep, char *back);
 
 /*The following definitions come from  lib/util_unistr.c  */
diff --git a/source/lib/util.c b/source/lib/util.c
index 346dc64954f..9e86d9abcaa 100644
--- a/source/lib/util.c
+++ b/source/lib/util.c
@@ -578,7 +578,7 @@ void dos_clean_name(char *s)
   DEBUG(3,("dos_clean_name [%s]\n",s));
 
   /* remove any double slashes */
-  string_sub(s, "\\\\", "\\");
+  pstring_sub(s, "\\\\", "\\");
 
   while ((p = strstr(s,"\\..\\")) != NULL)
     {
@@ -596,7 +596,7 @@ void dos_clean_name(char *s)
 
   trim_string(s,NULL,"\\..");
 
-  string_sub(s, "\\.\\", "\\");
+  pstring_sub(s, "\\.\\", "\\");
 }
 
 /*******************************************************************
@@ -609,7 +609,7 @@ void unix_clean_name(char *s)
   DEBUG(3,("unix_clean_name [%s]\n",s));
 
   /* remove any double slashes */
-  string_sub(s, "//","/");
+  pstring_sub(s, "//","/");
 
   /* Remove leading ./ characters */
   if(strncmp(s, "./", 2) == 0) {
@@ -676,7 +676,7 @@ BOOL reduce_name(char *s,char *dir,BOOL widelinks)
   DEBUG(3,("reduce_name [%s] [%s]\n",s,dir));
 
   /* remove any double slashes */
-  string_sub(s,"//","/");
+  pstring_sub(s,"//","/");
 
   pstrcpy(base_name,s);
   p = strrchr(base_name,'/');
@@ -1349,8 +1349,8 @@ BOOL mask_match(char *str, char *regexp, int case_sig,BOOL trans2)
     /*
      * Handle broken clients that send us old 8.3 format.
      */
-    string_sub(t_pattern,"????????","*");
-    string_sub(t_pattern,".???",".*");
+    pstring_sub(t_pattern,"????????","*");
+    pstring_sub(t_pattern,".???",".*");
 #endif
   }
 
@@ -1369,8 +1369,8 @@ BOOL mask_match(char *str, char *regexp, int case_sig,BOOL trans2)
 #endif
 
   /* Remove any *? and ** as they are meaningless */
-  string_sub(t_pattern, "*?", "*");
-  string_sub(t_pattern, "**", "*");
+  pstring_sub(t_pattern, "*?", "*");
+  pstring_sub(t_pattern, "**", "*");
 
   if (strequal(t_pattern,"*"))
     return(True);
@@ -1392,7 +1392,7 @@ BOOL mask_match(char *str, char *regexp, int case_sig,BOOL trans2)
     /*
      * Remove multiple "*." patterns.
      */
-    string_sub(te_pattern, "*.*.", "*.");
+    pstring_sub(te_pattern, "*.*.", "*.");
     num_regexp_components = count_chars(te_pattern, '.');
     num_path_components = count_chars(te_filename, '.');
 
@@ -1976,7 +1976,7 @@ static char *automount_lookup(char *user_name)
            DEBUG(3, ("NIS+ result: %s\n", entry->en_cols.en_cols_val[1].ec_value.ec_value_val));
  
            pstrcpy(last_value, entry->en_cols.en_cols_val[1].ec_value.ec_value_val);
-           string_sub(last_value, "&", user_name);
+           pstring_sub(last_value, "&", user_name);
            fstrcpy(last_key, user_name);
         }
       }
@@ -2131,7 +2131,7 @@ void standard_sub_basic(char *str)
 			{
 				if ((pass = Get_Pwnam(username,False))!=NULL)
 				{
-					string_sub(p,"%G",gidtoname(pass->pw_gid));
+					pstring_sub(p,"%G",gidtoname(pass->pw_gid));
 				}
 				else
 				{
@@ -2139,23 +2139,23 @@ void standard_sub_basic(char *str)
 				}
 				break;
 			}
-			case 'N' : string_sub(p,"%N", automount_server(username)); break;
-			case 'I' : string_sub(p,"%I", client_addr(Client)); break;
-			case 'L' : string_sub(p,"%L", local_machine); break;
-			case 'M' : string_sub(p,"%M", client_name(Client)); break;
-			case 'R' : string_sub(p,"%R", remote_proto); break;
-			case 'T' : string_sub(p,"%T", timestring()); break;
-			case 'U' : string_sub(p,"%U", username); break;
-			case 'a' : string_sub(p,"%a", remote_arch); break;
+			case 'N' : pstring_sub(p,"%N", automount_server(username)); break;
+			case 'I' : pstring_sub(p,"%I", client_addr(Client)); break;
+			case 'L' : pstring_sub(p,"%L", local_machine); break;
+			case 'M' : pstring_sub(p,"%M", client_name(Client)); break;
+			case 'R' : pstring_sub(p,"%R", remote_proto); break;
+			case 'T' : pstring_sub(p,"%T", timestring()); break;
+			case 'U' : pstring_sub(p,"%U", username); break;
+			case 'a' : pstring_sub(p,"%a", remote_arch); break;
 			case 'd' :
 			{
 				slprintf(pidstr,sizeof(pidstr) - 1, "%d",(int)getpid());
-				string_sub(p,"%d", pidstr);
+				pstring_sub(p,"%d", pidstr);
 				break;
 			}
-			case 'h' : string_sub(p,"%h", myhostname); break;
-			case 'm' : string_sub(p,"%m", remote_machine); break;
-			case 'v' : string_sub(p,"%v", VERSION); break;
+			case 'h' : pstring_sub(p,"%h", myhostname); break;
+			case 'm' : pstring_sub(p,"%m", remote_machine); break;
+			case 'v' : pstring_sub(p,"%v", VERSION); break;
 			case '$' : /* Expand environment variables */
 			{
 				/* Contributed by Branko Cibej <branko.cibej@hermes.si> */
@@ -2193,7 +2193,7 @@ void standard_sub_basic(char *str)
 				copylen = MIN((q+1-p),(sizeof(envname)-1));
 				strncpy(envname,p,copylen);
 				envname[copylen] = '\0';
-				string_sub(p,envname,envval);
+				pstring_sub(p,envname,envval);
 				break;
 			}
 			case '\0': p++; break; /* don't run off end if last character is % */
@@ -2215,27 +2215,27 @@ void standard_sub(connection_struct *conn,char *str)
 		switch (*(p+1)) {
 		case 'H': 
 			if ((home = get_home_dir(conn->user))) {
-				string_sub(p,"%H",home);
+				pstring_sub(p,"%H",home);
 			} else {
 				p += 2;
 			}
 			break;
 			
 		case 'P': 
-			string_sub(p,"%P",conn->connectpath); 
+			pstring_sub(p,"%P",conn->connectpath); 
 			break;
 			
 		case 'S': 
-			string_sub(p,"%S",
+			pstring_sub(p,"%S",
 				   lp_servicename(SNUM(conn))); 
 			break;
 			
 		case 'g': 
-			string_sub(p,"%g",
+			pstring_sub(p,"%g",
 				   gidtoname(conn->gid)); 
 			break;
 		case 'u': 
-			string_sub(p,"%u",conn->user); 
+			pstring_sub(p,"%u",conn->user); 
 			break;
 			
 			/* Patch from jkf@soton.ac.uk Left the %N (NIS
@@ -2246,7 +2246,7 @@ void standard_sub(connection_struct *conn,char *str)
 			 * "path =" string in [homes] and so needs the
 			 * service name, not the username.  */
 		case 'p': 
-			string_sub(p,"%p",
+			pstring_sub(p,"%p",
 				   automount_path(lp_servicename(SNUM(conn)))); 
 			break;
 		case '\0': 
diff --git a/source/lib/util_str.c b/source/lib/util_str.c
index f1de1d74126..5ac6ad13206 100644
--- a/source/lib/util_str.c
+++ b/source/lib/util_str.c
@@ -1064,8 +1064,9 @@ This routine looks for pattern in s and replaces it with
 insert. It may do multiple replacements.
 
 any of " ; ' or ` in the insert string are replaced with _
+if len==0 then no length check is performed
 ****************************************************************************/
-void string_sub(char *s,const char *pattern,const char *insert)
+void string_sub(char *s,const char *pattern,const char *insert, size_t len)
 {
 	char *p;
 	ssize_t ls,lp,li, i;
@@ -1079,6 +1080,12 @@ void string_sub(char *s,const char *pattern,const char *insert)
 	if (!*pattern) return;
 	
 	while (lp <= ls && (p = strstr(s,pattern))) {
+		if (ls + (li-lp) >= len) {
+			DEBUG(0,("ERROR: string overflow by %d in string_sub(%.50s, %d)\n", 
+				 (int)(ls + (li-lp) - len),
+				 pattern, (int)len));
+			break;
+		}
 		memmove(p+li,p+lp,ls + 1 - (PTR_DIFF(p,s) + lp));
 		for (i=0;i<li;i++) {
 			switch (insert[i]) {
@@ -1097,12 +1104,22 @@ void string_sub(char *s,const char *pattern,const char *insert)
 	}
 }
 
+void fstring_sub(char *s,const char *pattern,const char *insert)
+{
+	string_sub(s, pattern, insert, sizeof(fstring));
+}
+
+void pstring_sub(char *s,const char *pattern,const char *insert)
+{
+	string_sub(s, pattern, insert, sizeof(pstring));
+}
 
 /****************************************************************************
 similar to string_sub() but allows for any character to be substituted. 
 Use with caution!
+if len==0 then no length check is performed
 ****************************************************************************/
-void all_string_sub(char *s,const char *pattern,const char *insert)
+void all_string_sub(char *s,const char *pattern,const char *insert, size_t len)
 {
 	char *p;
 	ssize_t ls,lp,li;
@@ -1116,6 +1133,12 @@ void all_string_sub(char *s,const char *pattern,const char *insert)
 	if (!*pattern) return;
 	
 	while (lp <= ls && (p = strstr(s,pattern))) {
+		if (len && ls + (li-lp) >= len) {
+			DEBUG(0,("ERROR: string overflow by %d in all_string_sub(%.50s, %d)\n", 
+				 (int)(ls + (li-lp) - len),
+				 pattern, (int)len));
+			break;
+		}
 		memmove(p+li,p+lp,ls + 1 - (PTR_DIFF(p,s) + lp));
 		memcpy(p, insert, li);
 		s = p + li;
diff --git a/source/nmbd/nmbd_synclists.c b/source/nmbd/nmbd_synclists.c
index 3cdb42d72c0..ba162d60af3 100644
--- a/source/nmbd/nmbd_synclists.c
+++ b/source/nmbd/nmbd_synclists.c
@@ -147,7 +147,7 @@ void sync_browse_lists(struct work_record *work,
 
 	slprintf(s->fname, sizeof(pstring)-1,
 		 "%s/sync.%d", lp_lockdir(), counter++);
-	string_sub(s->fname,"//", "/");
+	pstring_sub(s->fname,"//", "/");
 	
 	DLIST_ADD(syncs, s);
 
diff --git a/source/nmbd/nmbd_winsserver.c b/source/nmbd/nmbd_winsserver.c
index 1f36c79f830..ef519cb9e74 100644
--- a/source/nmbd/nmbd_winsserver.c
+++ b/source/nmbd/nmbd_winsserver.c
@@ -1552,7 +1552,7 @@ void wins_write_database(BOOL background)
   }
 
   slprintf(fname,sizeof(fname),"%s/%s", lp_lockdir(), WINS_LIST);
-  string_sub(fname,"//", "/");
+  pstring_sub(fname,"//", "/");
   slprintf(fnamenew,sizeof(fnamenew),"%s.%u", fname, (unsigned int)getpid());
 
   if((fp = sys_fopen(fnamenew,"w")) == NULL)
diff --git a/source/passdb/ldap.c b/source/passdb/ldap.c
index bb05d211e48..43fea00a644 100644
--- a/source/passdb/ldap.c
+++ b/source/passdb/ldap.c
@@ -121,7 +121,7 @@ static BOOL ldap_search_one_user_by_name(LDAP *ldap_struct, char *user, LDAPMess
 	   so in ldap filter, %u MUST exist :-)
 	*/	
 	pstrcpy(filter,lp_ldap_filter());
-	string_sub(filter,"%u",user);
+	pstring_sub(filter,"%u",user);
 	
 	if ( !ldap_search_one_user(ldap_struct, filter, result) )
 	{
diff --git a/source/printing/printing.c b/source/printing/printing.c
index 8206902c27c..b0ec73b6fbe 100644
--- a/source/printing/printing.c
+++ b/source/printing/printing.c
@@ -76,10 +76,10 @@ static char *build_print_command(connection_struct *conn,
 	if (strstr(syscmd,"%s")) {
 		pstrcpy(filename,filename1);
     
-		string_sub(syscmd, "%s", filename);
+		pstring_sub(syscmd, "%s", filename);
 	}
   
-	string_sub(syscmd, "%f", filename1);
+	pstring_sub(syscmd, "%f", filename1);
   
 	/* Does the service have a printername? If not, make a fake
            and empty */
@@ -91,7 +91,7 @@ static char *build_print_command(connection_struct *conn,
 		tstr = SERVICE(snum);
 	}
   
-	string_sub(syscmd, "%p", tstr);
+	pstring_sub(syscmd, "%p", tstr);
   
 	standard_sub(conn,syscmd);
   
@@ -414,9 +414,9 @@ static BOOL parse_lpq_aix(char *line,print_queue_struct *buf,BOOL first)
   int count=0;
 
   /* handle the case of "(standard input)" as a filename */
-  string_sub(line,"standard input","STDIN");
-  all_string_sub(line,"(","\"");
-  all_string_sub(line,")","\"");
+  pstring_sub(line,"standard input","STDIN");
+  all_string_sub(line,"(","\"",0);
+  all_string_sub(line,")","\"",0);
 
   for (count=0; 
        count<10 && 
@@ -531,9 +531,9 @@ static BOOL parse_lpq_hpux(char * line, print_queue_struct *buf, BOOL first)
     }
     if (!header_line_ok) return (False); /* incorrect header line */
     /* handle the case of "(standard input)" as a filename */
-    string_sub(line,"standard input","STDIN");
-    all_string_sub(line,"(","\"");
-    all_string_sub(line,")","\"");
+    pstring_sub(line,"standard input","STDIN");
+    all_string_sub(line,"(","\"",0);
+    all_string_sub(line,")","\"",0);
     
     for (count=0; count<2 && next_token(&line,tok[count],NULL,sizeof(tok[count])); count++) ;
     /* we must get 2 tokens */
@@ -569,7 +569,7 @@ static BOOL parse_lpq_hpux(char * line, print_queue_struct *buf, BOOL first)
     else if (base_prio) base_prio_reset=False;
     
     /* handle the dash in the job id */
-    string_sub(line,"-"," ");
+    pstring_sub(line,"-"," ");
     
     for (count=0; count<12 && next_token(&line,tok[count],NULL,sizeof(tok[count])); count++) ;
       
@@ -619,7 +619,7 @@ static BOOL parse_lpq_sysv(char *line,print_queue_struct *buf,BOOL first)
   char *p;
 
   /* handle the dash in the job id */
-  string_sub(line,"-"," ");
+  pstring_sub(line,"-"," ");
   
   for (count=0; count<9 && next_token(&line,tok[count],NULL,sizeof(tok[count])); count++) ;
 
@@ -673,14 +673,14 @@ static BOOL parse_lpq_qnx(char *line,print_queue_struct *buf,BOOL first)
   DEBUG(4,("antes [%s]\n", line));
 
   /* handle the case of "-- standard input --" as a filename */
-  string_sub(line,"standard input","STDIN");
+  pstring_sub(line,"standard input","STDIN");
   DEBUG(4,("despues [%s]\n", line));
-  all_string_sub(line,"-- ","\"");
-  all_string_sub(line," --","\"");
+  all_string_sub(line,"-- ","\"",0);
+  all_string_sub(line," --","\"",0);
   DEBUG(4,("despues 1 [%s]\n", line));
 
-  string_sub(line,"[job #","");
-  string_sub(line,"]","");
+  pstring_sub(line,"[job #","");
+  pstring_sub(line,"]","");
   DEBUG(4,("despues 2 [%s]\n", line));
 
   
@@ -736,9 +736,9 @@ static BOOL parse_lpq_plp(char *line,print_queue_struct *buf,BOOL first)
   int count=0;
 
   /* handle the case of "(standard input)" as a filename */
-  string_sub(line,"stdin","STDIN");
-  all_string_sub(line,"(","\"");
-  all_string_sub(line,")","\"");
+  pstring_sub(line,"stdin","STDIN");
+  all_string_sub(line,"(","\"",0);
+  all_string_sub(line,")","\"",0);
   
   for (count=0; count<11 && next_token(&line,tok[count],NULL,sizeof(tok[count])); count++) ;
 
@@ -806,7 +806,7 @@ static BOOL parse_lpq_softq(char *line,print_queue_struct *buf,BOOL first)
   int count=0;
 
   /* mung all the ":"s to spaces*/
-  string_sub(line,":"," ");
+  pstring_sub(line,":"," ");
   
   for (count=0; count<10 && next_token(&line,tok[count],NULL,sizeof(tok[count])); count++) ;
 
@@ -993,7 +993,7 @@ int get_printqueue(int snum,
 	}
     
 	pstrcpy(syscmd,lpq_command);
-	string_sub(syscmd,"%p",printername);
+	pstring_sub(syscmd,"%p",printername);
 
 	standard_sub(conn,syscmd);
 
@@ -1082,8 +1082,8 @@ void del_printqueue(connection_struct *conn,int snum,int jobid)
   slprintf(jobstr,sizeof(jobstr)-1,"%d",jobid);
 
   pstrcpy(syscmd,lprm_command);
-  string_sub(syscmd,"%p",printername);
-  string_sub(syscmd,"%j",jobstr);
+  pstring_sub(syscmd,"%p",printername);
+  pstring_sub(syscmd,"%j",jobstr);
   standard_sub(conn,syscmd);
 
   ret = smbrun(syscmd,NULL,False);
@@ -1120,8 +1120,8 @@ void status_printjob(connection_struct *conn,int snum,int jobid,int status)
   slprintf(jobstr,sizeof(jobstr)-1,"%d",jobid);
 
   pstrcpy(syscmd,lpstatus_command);
-  string_sub(syscmd,"%p",printername);
-  string_sub(syscmd,"%j",jobstr);
+  pstring_sub(syscmd,"%p",printername);
+  pstring_sub(syscmd,"%j",jobstr);
   standard_sub(conn,syscmd);
 
   ret = smbrun(syscmd,NULL,False);
@@ -1176,7 +1176,7 @@ void status_printqueue(connection_struct *conn,int snum,int status)
   }
 
   pstrcpy(syscmd,queuestatus_command);
-  string_sub(syscmd,"%p",printername);
+  pstring_sub(syscmd,"%p",printername);
   standard_sub(conn,syscmd);
 
   ret = smbrun(syscmd,NULL,False);
diff --git a/source/smbd/chgpasswd.c b/source/smbd/chgpasswd.c
index dc16dad768e..3dac4287607 100644
--- a/source/smbd/chgpasswd.c
+++ b/source/smbd/chgpasswd.c
@@ -227,10 +227,10 @@ static int expect(int master,char *expected,char *buf)
 
 static void pwd_sub(char *buf)
 {
-  string_sub(buf,"\\n","\n");
-  string_sub(buf,"\\r","\r");
-  string_sub(buf,"\\s"," ");
-  string_sub(buf,"\\t","\t");
+	fstring_sub(buf,"\\n","\n");
+	fstring_sub(buf,"\\r","\r");
+	fstring_sub(buf,"\\s"," ");
+	fstring_sub(buf,"\\t","\t");
 }
 
 static void writestring(int fd,char *s)
@@ -447,13 +447,13 @@ BOOL chgpasswd(char *name,char *oldpass,char *newpass, BOOL as_root)
     }
   }
 
-  string_sub(passwordprogram,"%u",name);
-  all_string_sub(passwordprogram,"%o",oldpass);
-  all_string_sub(passwordprogram,"%n",newpass);
+  pstring_sub(passwordprogram,"%u",name);
+  all_string_sub(passwordprogram,"%o",oldpass,sizeof(pstring));
+  all_string_sub(passwordprogram,"%n",newpass,sizeof(pstring));
 
-  string_sub(chatsequence,"%u",name);
-  all_string_sub(chatsequence,"%o",oldpass);
-  all_string_sub(chatsequence,"%n",newpass);
+  pstring_sub(chatsequence,"%u",name);
+  all_string_sub(chatsequence,"%o",oldpass,sizeof(pstring));
+  all_string_sub(chatsequence,"%n",newpass,sizeof(pstring));
   return(chat_with_program(passwordprogram,name,chatsequence, as_root));
 }
 
diff --git a/source/smbd/ipc.c b/source/smbd/ipc.c
index bb21a899662..2b053f853b3 100644
--- a/source/smbd/ipc.c
+++ b/source/smbd/ipc.c
@@ -81,7 +81,7 @@ static int CopyExpanded(connection_struct *conn,
 	if (!src || !dst || !n || !(*dst)) return(0);
 
 	StrnCpy(buf,src,sizeof(buf)/2);
-	string_sub(buf,"%S",lp_servicename(snum));
+	pstring_sub(buf,"%S",lp_servicename(snum));
 	standard_sub(conn,buf);
 	StrnCpy(*dst,buf,*n);
 	l = strlen(*dst) + 1;
@@ -106,7 +106,7 @@ static int StrlenExpanded(connection_struct *conn, int snum, char* s)
 	pstring buf;
 	if (!s) return(0);
 	StrnCpy(buf,s,sizeof(buf)/2);
-	string_sub(buf,"%S",lp_servicename(snum));
+	pstring_sub(buf,"%S",lp_servicename(snum));
 	standard_sub(conn,buf);
 	return strlen(buf) + 1;
 }
@@ -116,7 +116,7 @@ static char* Expand(connection_struct *conn, int snum, char* s)
 	static pstring buf;
 	if (!s) return(NULL);
 	StrnCpy(buf,s,sizeof(buf)/2);
-	string_sub(buf,"%S",lp_servicename(snum));
+	pstring_sub(buf,"%S",lp_servicename(snum));
 	standard_sub(conn,buf);
 	return &buf[0];
 }
diff --git a/source/smbd/message.c b/source/smbd/message.c
index e60e3d9ed1a..d918a794985 100644
--- a/source/smbd/message.c
+++ b/source/smbd/message.c
@@ -78,9 +78,9 @@ static void msg_deliver(void)
       fstring alpha_msgto;
 
       pstrcpy(s,lp_msg_command());
-      string_sub(s,"%s",name);
-      string_sub(s,"%f",alpha_strcpy(alpha_msgfrom,msgfrom,sizeof(alpha_msgfrom)));
-      string_sub(s,"%t",alpha_strcpy(alpha_msgto,msgto,sizeof(alpha_msgto)));
+      pstring_sub(s,"%s",name);
+      pstring_sub(s,"%f",alpha_strcpy(alpha_msgfrom,msgfrom,sizeof(alpha_msgfrom)));
+      pstring_sub(s,"%t",alpha_strcpy(alpha_msgto,msgto,sizeof(alpha_msgto)));
       standard_sub_basic(s);
       smbrun(s,NULL,False);
     }
diff --git a/source/smbd/password.c b/source/smbd/password.c
index b8ed62af833..b68cce66fa4 100644
--- a/source/smbd/password.c
+++ b/source/smbd/password.c
@@ -571,8 +571,8 @@ BOOL user_ok(char *user,int snum)
 	StrnCpy(valid, lp_valid_users(snum), sizeof(pstring)-1);
 	StrnCpy(invalid, lp_invalid_users(snum), sizeof(pstring)-1);
 
-	string_sub(valid,"%S",lp_servicename(snum));
-	string_sub(invalid,"%S",lp_servicename(snum));
+	pstring_sub(valid,"%S",lp_servicename(snum));
+	pstring_sub(invalid,"%S",lp_servicename(snum));
 	
 	ret = !user_in_list(user,invalid);
 	
@@ -582,7 +582,7 @@ BOOL user_ok(char *user,int snum)
 
 	if (ret && lp_onlyuser(snum)) {
 		char *user_list = lp_username(snum);
-		string_sub(user_list,"%S",lp_servicename(snum));
+		pstring_sub(user_list,"%S",lp_servicename(snum));
 		ret = user_in_list(user,user_list);
 	}
 
@@ -754,7 +754,7 @@ BOOL authorise_login(int snum,char *user,char *password, int pwlen,
 	pstring user_list;
 	StrnCpy(user_list,lp_username(snum),sizeof(pstring));
 
-	string_sub(user_list,"%S",lp_servicename(snum));
+	pstring_sub(user_list,"%S",lp_servicename(snum));
 	  
 	for (auser=strtok(user_list,LIST_SEP);
 	     auser && !ok;
diff --git a/source/smbd/reply.c b/source/smbd/reply.c
index 11054f568ba..f2343be5c45 100644
--- a/source/smbd/reply.c
+++ b/source/smbd/reply.c
@@ -458,7 +458,7 @@ static int smb_create_user(char *unix_user)
   int ret;
 
   pstrcpy(add_script, lp_adduser_script());
-  string_sub(add_script, "%u", unix_user);
+  pstring_sub(add_script, "%u", unix_user);
   ret = smbrun(add_script,NULL,False);
   DEBUG(3,("smb_create_user: Running the command `%s' gave %d\n",add_script,ret));
   return ret;
@@ -474,7 +474,7 @@ static int smb_delete_user(char *unix_user)
   int ret;
 
   pstrcpy(del_script, lp_deluser_script());
-  string_sub(del_script, "%u", unix_user);
+  pstring_sub(del_script, "%u", unix_user);
   ret = smbrun(del_script,NULL,False);
   DEBUG(3,("smb_delete_user: Running the command `%s' gave %d\n",del_script,ret));
   return ret;
diff --git a/source/smbd/service.c b/source/smbd/service.c
index e7a86ae6ecf..60b711f8e52 100644
--- a/source/smbd/service.c
+++ b/source/smbd/service.c
@@ -84,7 +84,7 @@ int find_service(char *service)
 {
    int iService;
 
-   string_sub(service,"\\","/");
+   fstring_sub(service,"\\","/");
 
    iService = lp_servicenumber(service);
 
@@ -161,7 +161,7 @@ int find_service(char *service)
        iService = find_service(defservice);
        if (iService >= 0)
        {
-         string_sub(service,"_","/");
+         fstring_sub(service,"_","/");
          iService = lp_add_service(service,iService);
        }
      }
@@ -293,13 +293,13 @@ connection_struct *make_connection(char *service,char *user,char *password, int
 	{
 		pstring list;
 		StrnCpy(list,lp_readlist(snum),sizeof(pstring)-1);
-		string_sub(list,"%S",service);
+		pstring_sub(list,"%S",service);
 
 		if (user_in_list(user,list))
 			conn->read_only = True;
 		
 		StrnCpy(list,lp_writelist(snum),sizeof(pstring)-1);
-		string_sub(list,"%S",service);
+		pstring_sub(list,"%S",service);
 		
 		if (user_in_list(user,list))
 			conn->read_only = False;    
@@ -351,7 +351,7 @@ connection_struct *make_connection(char *service,char *user,char *password, int
 		pstrcpy(fuser,lp_force_user(snum));
 
 		/* Allow %S to be used by force user. */
-		string_sub(fuser,"%S",service);
+		pstring_sub(fuser,"%S",service);
 
 		pass2 = (struct passwd *)Get_Pwnam(fuser,True);
 		if (pass2) {
@@ -387,7 +387,7 @@ connection_struct *make_connection(char *service,char *user,char *password, int
 			StrnCpy(gname,tmp_gname,sizeof(pstring)-1);
 		}
 		/* default service may be a group name 		*/
-		string_sub(gname,"%S",service);
+		pstring_sub(gname,"%S",service);
 		gptr = (struct group *)getgrnam(gname);
 		
 		if (gptr) {
diff --git a/source/smbwrapper/smbw.c b/source/smbwrapper/smbw.c
index 79dfa7bd458..5b1fc7894fa 100644
--- a/source/smbwrapper/smbw.c
+++ b/source/smbwrapper/smbw.c
@@ -93,7 +93,7 @@ void smbw_init(void)
 
 	if ((p=smbw_getshared("PREFIX"))) {
 		slprintf(smbw_prefix,sizeof(fstring)-1, "/%s/", p);
-		string_sub(smbw_prefix,"//", "/");
+		fstring_sub(smbw_prefix,"//", "/");
 		DEBUG(2,("SMBW_PREFIX is %s\n", smbw_prefix));
 	}
 
@@ -320,7 +320,7 @@ char *smbw_parse_path(const char *fname, char *server, char *share, char *path)
 
 	pstrcpy(path,p);
 
-	string_sub(path, "/", "\\");
+	pstring_sub(path, "/", "\\");
 
  ok:
 	DEBUG(4,("parsed path name=%s cwd=%s [%s] [%s] [%s]\n", 
diff --git a/source/smbwrapper/smbw_dir.c b/source/smbwrapper/smbw_dir.c
index 95b2ac4b642..87f8d07743a 100644
--- a/source/smbwrapper/smbw_dir.c
+++ b/source/smbwrapper/smbw_dir.c
@@ -197,7 +197,7 @@ int smbw_dir_open(const char *fname)
 	cur_dir = dir;
 
 	slprintf(mask, sizeof(mask)-1, "%s\\*", path);
-	string_sub(mask,"\\\\","\\");
+	pstring_sub(mask,"\\\\","\\");
 
 	if ((p=strstr(srv->server_name,"#1D"))) {
 		DEBUG(4,("doing NetServerEnum\n"));
diff --git a/source/utils/torture.c b/source/utils/torture.c
index 55047dbb4ff..e7925fa2af6 100644
--- a/source/utils/torture.c
+++ b/source/utils/torture.c
@@ -305,7 +305,7 @@ static void run_netbench(int client)
 
 		/* printf("[%d] %s\n", line_count, line); */
 
-		all_string_sub(line,"CLIENT1", cname);
+		all_string_sub(line,"CLIENT1", cname, sizeof(line));
 		
 		for (i=0;i<20;i++) params[i] = "";
 
diff --git a/source/web/cgi.c b/source/web/cgi.c
index 275bf8999fe..5f4ac63d54c 100644
--- a/source/web/cgi.c
+++ b/source/web/cgi.c
@@ -571,7 +571,7 @@ void cgi_setup(char *rootdir, int auth_required)
 		*p = 0;
 	}
 
-	string_sub(url, "/swat/", "");
+	string_sub(url, "/swat/", "", 0);
 
 	if (strstr(url,"..")==0 && file_exist(url, NULL)) {
 		cgi_download(url);
diff --git a/source/web/statuspage.c b/source/web/statuspage.c
index 724ca8c1adf..dffc4d42bd2 100644
--- a/source/web/statuspage.c
+++ b/source/web/statuspage.c
@@ -26,7 +26,7 @@ static char *tstring(time_t t)
 {
 	static pstring buf;
 	pstrcpy(buf, asctime(LocalTime(&t)));
-	all_string_sub(buf," ","&nbsp;");
+	all_string_sub(buf," ","&nbsp;",sizeof(buf));
 	return buf;
 }