aboutsummaryrefslogtreecommitdiff
path: root/nx-X11/programs/Xserver
diff options
context:
space:
mode:
authorUlrich Sibiller <uli42@gmx.de>2018-01-03 01:11:34 +0100
committerUlrich Sibiller <uli42@gmx.de>2018-01-07 01:27:07 +0100
commit56fa234856428ca2de92c27904edb1fe28bc4fdc (patch)
tree63b0ecfc6e9c67d61a6fd118e4707f0f3394d4b5 /nx-X11/programs/Xserver
parentcac1af52d93222e3705ea20f999ba7178010963e (diff)
downloadnx-libs-56fa234856428ca2de92c27904edb1fe28bc4fdc.tar.gz
nx-libs-56fa234856428ca2de92c27904edb1fe28bc4fdc.tar.bz2
nx-libs-56fa234856428ca2de92c27904edb1fe28bc4fdc.zip
Font.c: replace memcpy by sprintf preventing possible buffer overflows
I am not sure about the maximum font name length in X but just in case use snprintf instead of memcpy to be sure nothing dangerous can happen here.
Diffstat (limited to 'nx-X11/programs/Xserver')
-rw-r--r--nx-X11/programs/Xserver/hw/nxagent/Font.c12
1 files changed, 3 insertions, 9 deletions
diff --git a/nx-X11/programs/Xserver/hw/nxagent/Font.c b/nx-X11/programs/Xserver/hw/nxagent/Font.c
index 5a9b729ed..540ad79e2 100644
--- a/nx-X11/programs/Xserver/hw/nxagent/Font.c
+++ b/nx-X11/programs/Xserver/hw/nxagent/Font.c
@@ -733,7 +733,7 @@ static XFontStruct *nxagentLoadBestQueryFont(Display* dpy, char *fontName, FontP
{
XFontStruct *fontStruct;
- char *substFontBuf;
+ char substFontBuf[512];;
/* X Logical Font Description Conventions
* require 14 fields in the font names.
@@ -767,12 +767,9 @@ static XFontStruct *nxagentLoadBestQueryFont(Display* dpy, char *fontName, FontP
fprintf(stderr, "nxagentLoadBestQueryFont: Searching font '%s' .\n", fontName);
#endif
- substFontBuf = (char *) malloc(sizeof(char) * 512);
-
-
numFontFields = nxagentSplitString(fontName, fontNameFields, FIELDS + 1, "-");
- memcpy(substFontBuf, "fixed\0", strlen("fixed") + 1);
+ snprintf(substFontBuf, sizeof(substFontBuf), "%s", "fixed");
if (numFontFields <= FIELDS)
{
@@ -831,8 +828,7 @@ static XFontStruct *nxagentLoadBestQueryFont(Display* dpy, char *fontName, FontP
/* Found more accurate font */
weight = tempWeight;
- memcpy(substFontBuf, nxagentRemoteFontList.list[i]->name, strlen(nxagentRemoteFontList.list[i]->name));
- substFontBuf[strlen(nxagentRemoteFontList.list[i]->name)] = '\0';
+ snprintf(substFontBuf, sizeof(substFontBuf), "%s", nxagentRemoteFontList.list[i]->name);
#ifdef NXAGENT_RECONNECT_FONT_DEBUG
fprintf(stderr, "nxagentLoadBestQueryFont: Weight '%d' of more accurate font '%s' .\n", weight, substFontBuf);
@@ -856,8 +852,6 @@ static XFontStruct *nxagentLoadBestQueryFont(Display* dpy, char *fontName, FontP
fontStruct = nxagentLoadQueryFont(dpy, substFontBuf, pFont);
- free (substFontBuf);
-
for (j = 0; j < numFontFields; j++)
{
free(fontNameFields[j]);