Convert instances of tor_malloc+tor_snprintf into tor_asprintf

These were found by looking for tor_snprintf() instances that were
preceeded closely by tor_malloc(), though I probably converted some
more snprintfs as well.

(In every case, make sure that the length variable (if any) is
removed, renamed, or lowered, so that anything else that might have
assumed a longer buffer doesn't exist.)

12 files changed, 57 insertions, 158 deletions

diff --git a/src/common/compat.c b/src/common/compat.c
index ff9d877cd..3af43e80c 100644
--- a/src/common/compat.c
+++ b/src/common/compat.c
@@ -1351,31 +1351,19 @@ log_credential_status(void)
     return -1;
   } else {
     int i, retval = 0;
-    char *strgid;
     char *s = NULL;
     smartlist_t *elts = smartlist_create();
 
     for (i = 0; i<ngids; i++) {
-      strgid = tor_malloc(11);
-      if (tor_snprintf(strgid, 11, "%u", (unsigned)sup_gids[i]) < 0) {
-        log_warn(LD_GENERAL, "Error printing supplementary GIDs");
-        tor_free(strgid);
-        retval = -1;
-        goto error;
-      }
-      smartlist_add(elts, strgid);
+      smartlist_add_asprintf(elts, "%u", (unsigned)sup_gids[i]);
     }
 
     s = smartlist_join_strings(elts, " ", 0, NULL);
 
     log_fn(CREDENTIAL_LOG_LEVEL, LD_GENERAL, "Supplementary groups are: %s",s);
 
-   error:
     tor_free(s);
-    SMARTLIST_FOREACH(elts, char *, cp,
-    {
-      tor_free(cp);
-    });
+    SMARTLIST_FOREACH(elts, char *, cp, tor_free(cp));
     smartlist_free(elts);
     tor_free(sup_gids);
 
diff --git a/src/common/util.c b/src/common/util.c
index a4a7006ad..3d8b7dabe 100644
--- a/src/common/util.c
+++ b/src/common/util.c
@@ -1964,7 +1964,6 @@ int
 start_writing_to_file(const char *fname, int open_flags, int mode,
                       open_file_t **data_out)
 {
-  size_t tempname_len = strlen(fname)+16;
   open_file_t *new_file = tor_malloc_zero(sizeof(open_file_t));
   const char *open_name;
   int append = 0;
@@ -1975,7 +1974,6 @@ start_writing_to_file(const char *fname, int open_flags, int mode,
   tor_assert((open_flags & (O_BINARY|O_TEXT)) != 0);
 #endif
   new_file->fd = -1;
-  tor_assert(tempname_len > strlen(fname)); /*check for overflow*/
   new_file->filename = tor_strdup(fname);
   if (open_flags & O_APPEND) {
     open_name = fname;
@@ -1983,11 +1981,8 @@ start_writing_to_file(const char *fname, int open_flags, int mode,
     append = 1;
     open_flags &= ~O_APPEND;
   } else {
-    open_name = new_file->tempname = tor_malloc(tempname_len);
-    if (tor_snprintf(new_file->tempname, tempname_len, "%s.tmp", fname)<0) {
-      log_warn(LD_GENERAL, "Failed to generate filename");
-      goto err;
-    }
+    tor_asprintf(&new_file->tempname, "%s.tmp", fname);
+    open_name = new_file->tempname;
     /* We always replace an existing temporary file if there is one. */
     open_flags |= O_CREAT|O_TRUNC;
     open_flags &= ~O_EXCL;
@@ -2786,14 +2781,12 @@ tor_listdir(const char *dirname)
 {
   smartlist_t *result;
 #ifdef MS_WINDOWS
-  char *pattern;
+  char *pattern=NULL;
   TCHAR tpattern[MAX_PATH] = {0};
   char name[MAX_PATH] = {0};
   HANDLE handle;
   WIN32_FIND_DATA findData;
-  size_t pattern_len = strlen(dirname)+16;
-  pattern = tor_malloc(pattern_len);
-  tor_snprintf(pattern, pattern_len, "%s\\*", dirname);
+  tor_asprintf(&pattern, "%s\\*", dirname);
 #ifdef UNICODE
   mbstowcs(tpattern,pattern,MAX_PATH);
 #else
diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c
index 88916d659..d157dbd1a 100644
--- a/src/or/circuitbuild.c
+++ b/src/or/circuitbuild.c
@@ -675,8 +675,7 @@ circuit_build_times_update_state(circuit_build_times_t *cbt,
     if (histogram[i] == 0) continue;
     *next = line = tor_malloc_zero(sizeof(config_line_t));
     line->key = tor_strdup("CircuitBuildTimeBin");
-    line->value = tor_malloc(25);
-    tor_snprintf(line->value, 25, "%d %d",
+    tor_asprintf(&line->value, "%d %d",
             CBT_BIN_TO_MS(i), histogram[i]);
     next = &(line->next);
   }
@@ -1592,11 +1591,8 @@ circuit_list_path_impl(origin_circuit_t *circ, int verbose, int verbose_names)
     }
     tor_assert(elt);
     if (verbose) {
-      size_t len = strlen(elt)+2+strlen(states[hop->state])+1;
-      char *v = tor_malloc(len);
       tor_assert(hop->state <= 2);
-      tor_snprintf(v,len,"%s(%s)",elt,states[hop->state]);
-      smartlist_add(elements, v);
+      smartlist_add_asprintf(elements,"%s(%s)",elt,states[hop->state]);
       tor_free(elt);
     } else {
       smartlist_add(elements, elt);
@@ -3751,9 +3747,8 @@ remove_obsolete_entry_guards(time_t now)
       msg = "does not seem to be from any recognized version of Tor";
       version_is_bad = 1;
     } else {
-      size_t len = strlen(ver)+5;
-      char *tor_ver = tor_malloc(len);
-      tor_snprintf(tor_ver, len, "Tor %s", ver);
+      char *tor_ver = NULL;
+      tor_asprintf(&tor_ver, "Tor %s", ver);
       if ((tor_version_as_new_as(tor_ver, "0.1.0.10-alpha") &&
            !tor_version_as_new_as(tor_ver, "0.1.2.16-dev")) ||
           (tor_version_as_new_as(tor_ver, "0.2.0.0-alpha") &&
@@ -4466,15 +4461,11 @@ entry_guards_update_state(or_state_t *state)
           !strchr(e->chosen_by_version, ' ')) {
         char d[HEX_DIGEST_LEN+1];
         char t[ISO_TIME_LEN+1];
-        size_t val_len;
         *next = line = tor_malloc_zero(sizeof(config_line_t));
         line->key = tor_strdup("EntryGuardAddedBy");
-        val_len = (HEX_DIGEST_LEN+1+strlen(e->chosen_by_version)
-                   +1+ISO_TIME_LEN+1);
-        line->value = tor_malloc(val_len);
         base16_encode(d, sizeof(d), e->identity, DIGEST_LEN);
         format_iso_time(t, e->chosen_on_date);
-        tor_snprintf(line->value, val_len, "%s %s %s",
+        tor_asprintf(&line->value, "%s %s %s",
                      d, e->chosen_by_version, t);
         next = &(line->next);
       }
@@ -4506,8 +4497,6 @@ getinfo_helper_entry_guards(control_connection_t *conn,
     if (!entry_guards)
       entry_guards = smartlist_create();
     SMARTLIST_FOREACH_BEGIN(entry_guards, entry_guard_t *, e) {
-        size_t len = MAX_VERBOSE_NICKNAME_LEN+ISO_TIME_LEN+32;
-        char *c = tor_malloc(len);
         const char *status = NULL;
         time_t when = 0;
         const node_t *node;
@@ -4533,11 +4522,10 @@ getinfo_helper_entry_guards(control_connection_t *conn,
 
         if (when) {
           format_iso_time(tbuf, when);
-          tor_snprintf(c, len, "%s %s %s\n", nbuf, status, tbuf);
+          smartlist_add_asprintf(sl, "%s %s %s\n", nbuf, status, tbuf);
         } else {
-          tor_snprintf(c, len, "%s %s\n", nbuf, status);
+          smartlist_add_asprintf(sl, "%s %s\n", nbuf, status);
         }
-        smartlist_add(sl, c);
     } SMARTLIST_FOREACH_END(e);
     *answer = smartlist_join_strings(sl, "", 0, NULL);
     SMARTLIST_FOREACH(sl, char *, c, tor_free(c));
diff --git a/src/or/config.c b/src/or/config.c
index a477a096b..0763058d4 100644
--- a/src/or/config.c
+++ b/src/or/config.c
@@ -1647,10 +1647,8 @@ options_act(const or_options_t *old_options)
 #ifdef WIN32
     if (!strcmp(actual_fname, "<default>")) {
       const char *conf_root = get_windows_conf_root();
-      size_t len = strlen(conf_root)+16;
       tor_free(actual_fname);
-      actual_fname = tor_malloc(len+1);
-      tor_snprintf(actual_fname, len, "%s\\geoip", conf_root);
+      tor_asprintf(&actual_fname, "%s\\geoip", conf_root);
     }
 #endif
     geoip_load_file(actual_fname, options);
@@ -6144,18 +6142,12 @@ write_configuration_file(const char *fname, const or_options_t *options)
 
   if (rename_old) {
     int i = 1;
-    size_t fn_tmp_len = strlen(fname)+32;
-    char *fn_tmp;
-    tor_assert(fn_tmp_len > strlen(fname)); /*check for overflow*/
-    fn_tmp = tor_malloc(fn_tmp_len);
+    char *fn_tmp = NULL;
     while (1) {
-      if (tor_snprintf(fn_tmp, fn_tmp_len, "%s.orig.%d", fname, i)<0) {
-        log_warn(LD_BUG, "tor_snprintf failed inexplicably");
-        tor_free(fn_tmp);
-        goto err;
-      }
+      tor_asprintf(&fn_tmp, "%s.orig.%d", fname, i);
       if (file_status(fn_tmp) == FN_NOENT)
         break;
+      tor_free(fn_tmp);
       ++i;
     }
     log_notice(LD_CONFIG, "Renaming old configuration file to \"%s\"", fn_tmp);
@@ -6602,13 +6594,13 @@ or_state_save_broken(char *fname)
 {
   int i;
   file_status_t status;
-  size_t len = strlen(fname)+16;
-  char *fname2 = tor_malloc(len);
+  char *fname2 = NULL;
   for (i = 0; i < 100; ++i) {
-    tor_snprintf(fname2, len, "%s.%d", fname, i);
+    tor_asprintf(&fname2, "%s.%d", fname, i);
     status = file_status(fname2);
     if (status == FN_NOENT)
       break;
+    tor_free(fname2);
   }
   if (i == 100) {
     log_warn(LD_BUG, "Unable to parse state in \"%s\"; too many saved bad "
diff --git a/src/or/connection_edge.c b/src/or/connection_edge.c
index 7de627d72..dcb9cae42 100644
--- a/src/or/connection_edge.c
+++ b/src/or/connection_edge.c
@@ -909,13 +909,10 @@ addressmap_ent_remove(const char *address, addressmap_entry_t *ent)
 static void
 clear_trackexithost_mappings(const char *exitname)
 {
-  char *suffix;
-  size_t suffix_len;
+  char *suffix = NULL;
   if (!addressmap || !exitname)
     return;
-  suffix_len = strlen(exitname) + 16;
-  suffix = tor_malloc(suffix_len);
-  tor_snprintf(suffix, suffix_len, ".%s.exit", exitname);
+  tor_asprintf(&suffix, ".%s.exit", exitname);
   tor_strlower(suffix);
 
   STRMAP_FOREACH_MODIFY(addressmap, address, addressmap_entry_t *, ent) {
@@ -1402,9 +1399,8 @@ client_dns_set_reverse_addressmap(const char *address, const char *v,
                                   const char *exitname,
                                   int ttl)
 {
-  size_t len = strlen(address) + 16;
-  char *s = tor_malloc(len);
-  tor_snprintf(s, len, "REVERSE[%s]", address);
+  char *s = NULL;
+  tor_asprintf(&s, "REVERSE[%s]", address);
   client_dns_set_addressmap_impl(s, v, exitname, ttl);
   tor_free(s);
 }
@@ -1688,21 +1684,18 @@ addressmap_get_mappings(smartlist_t *sl, time_t min_expires,
          addressmap_ent_remove(key, val);
          continue;
        } else if (val->new_address) {
-         size_t len = strlen(key)+strlen(val->new_address)+ISO_TIME_LEN+5;
-         char *line = tor_malloc(len);
          if (want_expiry) {
            if (val->expires < 3 || val->expires == TIME_MAX)
-             tor_snprintf(line, len, "%s %s NEVER", key, val->new_address);
+             smartlist_add_asprintf(sl, "%s %s NEVER", key, val->new_address);
            else {
              char time[ISO_TIME_LEN+1];
              format_iso_time(time, val->expires);
-             tor_snprintf(line, len, "%s %s \"%s\"", key, val->new_address,
+             smartlist_add_asprintf(sl, "%s %s \"%s\"", key, val->new_address,
                           time);
            }
          } else {
-           tor_snprintf(line, len, "%s %s", key, val->new_address);
+           smartlist_add_asprintf(sl, "%s %s", key, val->new_address);
          }
-         smartlist_add(sl, line);
        }
      }
      iter = strmap_iter_next(addressmap,iter);
diff --git a/src/or/control.c b/src/or/control.c
index 70bdadbb3..2548a5c20 100644
--- a/src/or/control.c
+++ b/src/or/control.c
@@ -814,19 +814,13 @@ handle_control_getconf(control_connection_t *conn, uint32_t body_len,
       config_line_t *answer = option_get_assignment(options,q);
       if (!answer) {
         const char *name = option_get_canonical_name(q);
-        size_t alen = strlen(name)+8;
-        char *astr = tor_malloc(alen);
-        tor_snprintf(astr, alen, "250-%s\r\n", name);
-        smartlist_add(answers, astr);
+        smartlist_add_asprintf(answers, "250-%s\r\n", name);
       }
 
       while (answer) {
         config_line_t *next;
-        size_t alen = strlen(answer->key)+strlen(answer->value)+8;
-        char *astr = tor_malloc(alen);
-        tor_snprintf(astr, alen, "250-%s=%s\r\n",
+        smartlist_add_asprintf(answers, "250-%s=%s\r\n",
                      answer->key, answer->value);
-        smartlist_add(answers, astr);
 
         next = answer->next;
         tor_free(answer->key);
@@ -1658,13 +1652,13 @@ getinfo_helper_dir(control_connection_t *control_conn,
                               ri->cache_info.annotations_len);
     }
   } else if (!strcmpstart(question, "dir/server/")) {
-    size_t answer_len = 0, url_len = strlen(question)+2;
-    char *url = tor_malloc(url_len);
+    size_t answer_len = 0;
+    char *url = NULL;
     smartlist_t *descs = smartlist_create();
     const char *msg;
     int res;
     char *cp;
-    tor_snprintf(url, url_len, "/tor/%s", question+4);
+    tor_asprintf(&url, "/tor/%s", question+4);
     res = dirserv_get_routerdescs(descs, url, &msg);
     if (res) {
       log_warn(LD_CONTROL, "getinfo '%s': %s", question, msg);
@@ -1852,8 +1846,7 @@ getinfo_helper_events(control_connection_t *control_conn,
     smartlist_t *status = smartlist_create();
     for (circ_ = _circuit_get_global_list(); circ_; circ_ = circ_->next) {
       origin_circuit_t *circ;
-      char *s, *circdesc;
-      size_t slen;
+      char *circdesc;
       const char *state;
       if (! CIRCUIT_IS_ORIGIN(circ_) || circ_->marked_for_close)
         continue;
@@ -1868,12 +1861,9 @@ getinfo_helper_events(control_connection_t *control_conn,
 
       circdesc = circuit_describe_status_for_controller(circ);
 
-      slen = strlen(circdesc)+strlen(state)+30;
-      s = tor_malloc(slen+1);
-      tor_snprintf(s, slen, "%lu %s%s%s",
+      smartlist_add_asprintf(status, "%lu %s%s%s",
                    (unsigned long)circ->global_identifier,
                    state, *circdesc ? " " : "", circdesc);
-      smartlist_add(status, s);
       tor_free(circdesc);
     }
     *answer = smartlist_join_strings(status, "\r\n", 0, NULL);
@@ -1886,8 +1876,6 @@ getinfo_helper_events(control_connection_t *control_conn,
     SMARTLIST_FOREACH_BEGIN(conns, connection_t *, base_conn) {
       const char *state;
       entry_connection_t *conn;
-      char *s;
-      size_t slen;
       circuit_t *circ;
       origin_circuit_t *origin_circ = NULL;
       if (base_conn->type != CONN_TYPE_AP ||
@@ -1922,14 +1910,11 @@ getinfo_helper_events(control_connection_t *control_conn,
       if (circ && CIRCUIT_IS_ORIGIN(circ))
         origin_circ = TO_ORIGIN_CIRCUIT(circ);
       write_stream_target_to_buf(conn, buf, sizeof(buf));
-      slen = strlen(buf)+strlen(state)+32;
-      s = tor_malloc(slen+1);
-      tor_snprintf(s, slen, "%lu %s %lu %s",
+      smartlist_add_asprintf(status, "%lu %s %lu %s",
                    (unsigned long) base_conn->global_identifier,state,
                    origin_circ?
                          (unsigned long)origin_circ->global_identifier : 0ul,
                    buf);
-      smartlist_add(status, s);
     } SMARTLIST_FOREACH_END(base_conn);
     *answer = smartlist_join_strings(status, "\r\n", 0, NULL);
     SMARTLIST_FOREACH(status, char *, cp, tor_free(cp));
@@ -1939,9 +1924,7 @@ getinfo_helper_events(control_connection_t *control_conn,
     smartlist_t *status = smartlist_create();
     SMARTLIST_FOREACH_BEGIN(conns, connection_t *, base_conn) {
       const char *state;
-      char *s;
       char name[128];
-      size_t slen;
       or_connection_t *conn;
       if (base_conn->type != CONN_TYPE_OR || base_conn->marked_for_close)
         continue;
@@ -1953,10 +1936,7 @@ getinfo_helper_events(control_connection_t *control_conn,
       else
         state = "NEW";
       orconn_target_get_name(name, sizeof(name), conn);
-      slen = strlen(name)+strlen(state)+2;
-      s = tor_malloc(slen+1);
-      tor_snprintf(s, slen, "%s %s", name, state);
-      smartlist_add(status, s);
+      smartlist_add_asprintf(status, "%s %s", name, state);
     } SMARTLIST_FOREACH_END(base_conn);
     *answer = smartlist_join_strings(status, "\r\n", 0, NULL);
     SMARTLIST_FOREACH(status, char *, cp, tor_free(cp));
@@ -3513,8 +3493,7 @@ control_event_stream_status(entry_connection_t *conn, stream_status_event_t tp,
     const char *reason_str = stream_end_reason_to_control_string(reason_code);
     char *r = NULL;
     if (!reason_str) {
-      r = tor_malloc(16);
-      tor_snprintf(r, 16, " UNKNOWN_%d", reason_code);
+      tor_asprintf(&r, " UNKNOWN_%d", reason_code);
       reason_str = r;
     }
     if (reason_code & END_STREAM_REASON_FLAG_REMOTE)
@@ -3799,16 +3778,13 @@ control_event_descriptors_changed(smartlist_t *routers)
   {
     smartlist_t *names = smartlist_create();
     char *ids;
-    size_t names_len;
     SMARTLIST_FOREACH(routers, routerinfo_t *, ri, {
         char *b = tor_malloc(MAX_VERBOSE_NICKNAME_LEN+1);
         router_get_verbose_nickname(b, ri);
         smartlist_add(names, b);
       });
-    ids = smartlist_join_strings(names, " ", 0, &names_len);
-    names_len = strlen(ids)+32;
-    msg = tor_malloc(names_len);
-    tor_snprintf(msg, names_len, "650 NEWDESC %s\r\n", ids);
+    ids = smartlist_join_strings(names, " ", 0, NULL);
+    tor_asprintf(&msg, "650 NEWDESC %s\r\n", ids);
     send_control_event_string(EVENT_NEW_DESC, ALL_FORMATS, msg);
     tor_free(ids);
     tor_free(msg);
diff --git a/src/or/directory.c b/src/or/directory.c
index 572091a16..94c37f18d 100644
--- a/src/or/directory.c
+++ b/src/or/directory.c
@@ -2463,11 +2463,9 @@ note_client_request(int purpose, int compressed, size_t bytes)
     case DIR_PURPOSE_UPLOAD_RENDDESC_V2:  kind = "dl/ul-rend2"; break;
   }
   if (kind) {
-    key = tor_malloc(256);
-    tor_snprintf(key, 256, "%s%s", kind, compressed?".z":"");
+    tor_asprintf(&key, "%s%s", kind, compressed?".z":"");
   } else {
-    key = tor_malloc(256);
-    tor_snprintf(key, 256, "unknown purpose (%d)%s",
+    tor_asprintf(&key, "unknown purpose (%d)%s",
                  purpose, compressed?".z":"");
   }
   note_request(key, bytes);
diff --git a/src/or/hibernate.c b/src/or/hibernate.c
index 803f7f576..917bd8205 100644
--- a/src/or/hibernate.c
+++ b/src/or/hibernate.c
@@ -976,8 +976,7 @@ getinfo_helper_accounting(control_connection_t *conn,
     else
       *answer = tor_strdup("awake");
   } else if (!strcmp(question, "accounting/bytes")) {
-    *answer = tor_malloc(32);
-    tor_snprintf(*answer, 32, U64_FORMAT" "U64_FORMAT,
+    tor_asprintf(answer, U64_FORMAT" "U64_FORMAT,
                  U64_PRINTF_ARG(n_bytes_read_in_interval),
                  U64_PRINTF_ARG(n_bytes_written_in_interval));
   } else if (!strcmp(question, "accounting/bytes-left")) {
@@ -987,8 +986,7 @@ getinfo_helper_accounting(control_connection_t *conn,
       read_left = limit - n_bytes_read_in_interval;
     if (n_bytes_written_in_interval < limit)
       write_left = limit - n_bytes_written_in_interval;
-    *answer = tor_malloc(64);
-    tor_snprintf(*answer, 64, U64_FORMAT" "U64_FORMAT,
+    tor_asprintf(answer, U64_FORMAT" "U64_FORMAT,
                  U64_PRINTF_ARG(read_left), U64_PRINTF_ARG(write_left));
   } else if (!strcmp(question, "accounting/interval-start")) {
     *answer = tor_malloc(ISO_TIME_LEN+1);
diff --git a/src/or/networkstatus.c b/src/or/networkstatus.c
index 0a1fc08bf..a4e8644f2 100644
--- a/src/or/networkstatus.c
+++ b/src/or/networkstatus.c
@@ -2159,9 +2159,8 @@ networkstatus_dump_bridge_status_to_file(time_t now)
 {
   char *status = networkstatus_getinfo_by_purpose("bridge", now);
   const or_options_t *options = get_options();
-  size_t len = strlen(options->DataDirectory) + 32;
-  char *fname = tor_malloc(len);
-  tor_snprintf(fname, len, "%s"PATH_SEPARATOR"networkstatus-bridges",
+  char *fname = NULL;
+  tor_asprintf(&fname, "%s"PATH_SEPARATOR"networkstatus-bridges",
                options->DataDirectory);
   write_str_to_file(fname,status,0);
   tor_free(fname);
diff --git a/src/or/ntmain.c b/src/or/ntmain.c
index 8d03ea808..da19573a4 100644
--- a/src/or/ntmain.c
+++ b/src/or/ntmain.c
@@ -456,9 +456,9 @@ nt_service_command_line(int *using_default_torrc)
 {
   TCHAR tor_exe[MAX_PATH+1];
   char tor_exe_ascii[MAX_PATH+1];
-  char *command, *options=NULL;
+  char *command=NULL, *options=NULL;
   smartlist_t *sl;
-  int i, cmdlen;
+  int i;
   *using_default_torrc = 1;
 
   /* Get the location of tor.exe */
@@ -487,21 +487,13 @@ nt_service_command_line(int *using_default_torrc)
   strlcpy(tor_exe_ascii, tor_exe, sizeof(tor_exe_ascii));
 #endif
 
-  /* Allocate a string for the NT service command line */
-  cmdlen = strlen(tor_exe_ascii) + (options?strlen(options):0) + 32;
-  command = tor_malloc(cmdlen);
-
+  /* Allocate a string for the NT service command line and */
   /* Format the service command */
   if (options) {
-    if (tor_snprintf(command, cmdlen, "\"%s\" --nt-service \"%s\"",
-                     tor_exe_ascii, options)<0) {
-      tor_free(command); /* sets command to NULL. */
-    }
+    tor_asprintf(&command, "\"%s\" --nt-service \"%s\"",
+                 tor_exe_ascii, options);
   } else { /* ! options */
-    if (tor_snprintf(command, cmdlen, "\"%s\" --nt-service",
-                     tor_exe_ascii)<0) {
-      tor_free(command); /* sets command to NULL. */
-    }
+    tor_asprintf(&command, "\"%s\" --nt-service", tor_exe_ascii);
   }
 
   tor_free(options);
diff --git a/src/or/policies.c b/src/or/policies.c
index 34cb64bd8..53cdf4840 100644
--- a/src/or/policies.c
+++ b/src/or/policies.c
@@ -1218,7 +1218,7 @@ policy_summarize(smartlist_t *policy)
   smartlist_t *summary = policy_summary_create();
   smartlist_t *accepts, *rejects;
   int i, last, start_prt;
-  size_t accepts_len, rejects_len, shorter_len, final_size;
+  size_t accepts_len, rejects_len;
   char *accepts_str = NULL, *rejects_str = NULL, *shorter_str, *result;
   const char *prefix;
 
@@ -1290,21 +1290,15 @@ policy_summarize(smartlist_t *policy)
     tor_assert(*c == ',');
     *c = '\0';
 
-    shorter_len = strlen(shorter_str);
   } else if (rejects_len < accepts_len) {
     shorter_str = rejects_str;
-    shorter_len = rejects_len;
     prefix = "reject";
   } else {
     shorter_str = accepts_str;
-    shorter_len = accepts_len;
     prefix = "accept";
   }
 
-  final_size = strlen(prefix)+1+shorter_len+1;
-  tor_assert(final_size <= MAX_EXITPOLICY_SUMMARY_LEN+1);
-  result = tor_malloc(final_size);
-  tor_snprintf(result, final_size, "%s %s", prefix, shorter_str);
+  tor_asprintf(&result, "%s %s", prefix, shorter_str);
 
  cleanup:
   /* cleanup */
diff --git a/src/or/routerlist.c b/src/or/routerlist.c
index 689df99c5..b81289e85 100644
--- a/src/or/routerlist.c
+++ b/src/or/routerlist.c
@@ -2408,8 +2408,6 @@ router_get_by_nickname(const char *nickname, int warn_if_unnamed)
       int any_unwarned = 0;
       SMARTLIST_FOREACH_BEGIN(routerlist->routers, routerinfo_t *, router) {
           routerstatus_t *rs;
-          char *desc;
-          size_t dlen;
           char fp[HEX_DIGEST_LEN+1];
           if (strcasecmp(router->nickname, nickname))
             continue;
@@ -2421,11 +2419,8 @@ router_get_by_nickname(const char *nickname, int warn_if_unnamed)
           }
           base16_encode(fp, sizeof(fp),
                         router->cache_info.identity_digest, DIGEST_LEN);
-          dlen = 32 + HEX_DIGEST_LEN + strlen(router->address);
-          desc = tor_malloc(dlen);
-          tor_snprintf(desc, dlen, "\"$%s\" for the one at %s:%d",
+          smartlist_add_asprintf(fps, "\"$%s\" for the one at %s:%d",
                        fp, router->address, router->or_port);
-          smartlist_add(fps, desc);
       } SMARTLIST_FOREACH_END(router);
       if (any_unwarned) {
         char *alternatives = smartlist_join_strings(fps, "; ",0,NULL);
@@ -4071,7 +4066,6 @@ add_trusted_dir_server(const char *nickname, const char *address,
   trusted_dir_server_t *ent;
   uint32_t a;
   char *hostname = NULL;
-  size_t dlen;
   if (!trusted_dir_servers)
     trusted_dir_servers = smartlist_create();
 
@@ -4104,13 +4098,11 @@ add_trusted_dir_server(const char *nickname, const char *address,
   if (v3_auth_digest && (type & V3_DIRINFO))
     memcpy(ent->v3_identity_digest, v3_auth_digest, DIGEST_LEN);
 
-  dlen = 64 + strlen(hostname) + (nickname?strlen(nickname):0);
-  ent->description = tor_malloc(dlen);
   if (nickname)
-    tor_snprintf(ent->description, dlen, "directory server \"%s\" at %s:%d",
+    tor_asprintf(&ent->description, "directory server \"%s\" at %s:%d",
                  nickname, hostname, (int)dir_port);
   else
-    tor_snprintf(ent->description, dlen, "directory server at %s:%d",
+    tor_asprintf(&ent->description, "directory server at %s:%d",
                  hostname, (int)dir_port);
 
   ent->fake_status.addr = ent->addr;
@@ -5333,7 +5325,6 @@ esc_router_info(const routerinfo_t *router)
 {
   static char *info=NULL;
   char *esc_contact, *esc_platform;
-  size_t len;
   tor_free(info);
 
   if (!router)
@@ -5342,10 +5333,7 @@ esc_router_info(const routerinfo_t *router)
   esc_contact = esc_for_log(router->contact_info);
   esc_platform = esc_for_log(router->platform);
 
-  len = strlen(esc_contact)+strlen(esc_platform)+32;
-  info = tor_malloc(len);
-  tor_snprintf(info, len, "Contact %s, Platform %s", esc_contact,
-               esc_platform);
+  tor_asprintf(&info, "Contact %s, Platform %s", esc_contact, esc_platform);
   tor_free(esc_contact);
   tor_free(esc_platform);