From 20470a83e3a57f936cd90856325b897fa115b9ad Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Erkki=20Sepp=C3=A4l=C3=A4?= Date: Mon, 31 Jan 2011 14:01:57 +0200 Subject: XlibInt: Use strncpy+zero termination instead of strcpy to enforce buffer size MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Possible overrun of 8192 byte fixed size buffer "buffer" by copying "ext->name" without length checking Reviewed-by: Alan Coopersmith Reviewed-by: Ander Conselvan de Oliveira Signed-off-by: Erkki Seppälä Signed-off-by: Alan Coopersmith Backported-to-NX-by: Ulrich Sibiller --- nx-X11/lib/X11/XlibInt.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) (limited to 'nx-X11/lib/X11/XlibInt.c') diff --git a/nx-X11/lib/X11/XlibInt.c b/nx-X11/lib/X11/XlibInt.c index 23717fd7f..151e521bd 100644 --- a/nx-X11/lib/X11/XlibInt.c +++ b/nx-X11/lib/X11/XlibInt.c @@ -3528,9 +3528,10 @@ static int _XPrintDefaultError( ext && (ext->codes.major_opcode != event->request_code); ext = ext->next) ; - if (ext) - strcpy(buffer, ext->name); - else + if (ext) { + strncpy(buffer, ext->name, BUFSIZ); + buffer[BUFSIZ - 1] = '\0'; + } else buffer[0] = '\0'; } (void) fprintf(fp, " (%s)\n", buffer); -- cgit v1.2.3