|
 |
87e702 |
From 1fce38a3b2dc10c5bdd2c9f97c08c66dce7f0a95 Mon Sep 17 00:00:00 2001
|
|
|
87e702 |
From: "G. Branden Robinson" <g.branden.robinson@gmail.com>
|
|
|
87e702 |
Date: Tue, 1 Dec 2020 16:37:16 +1100
|
|
|
87e702 |
Subject: [PATCH 6/7] [xtotroff]: Avoid overrunning buffer write.
|
|
|
87e702 |
|
|
|
87e702 |
* src/utils/xtotroff/xtotroff.c (MapFont): Avoid writing past
|
|
|
87e702 |
the end of a static buffer. Problem found and patch supplied by
|
|
|
87e702 |
Bjarni Ingi Gislason. I tweaked it to comment it differently (in case
|
|
|
87e702 |
the buffer ever needs to grow, but the prospects of future X11
|
|
|
87e702 |
server-side font rendering development seem dim) and use snprintf()
|
|
|
87e702 |
instead of retaining the existing sprintf().
|
|
|
87e702 |
|
|
|
87e702 |
Quiets warning: '%s' directive writing up to 255 bytes into a region
|
|
|
87e702 |
of size between 0 and 255 [-Wformat-overflow=].
|
|
|
87e702 |
---
|
|
|
87e702 |
src/utils/xtotroff/xtotroff.c | 7 +++++--
|
|
|
87e702 |
1 file changed, 5 insertions(+), 2 deletions(-)
|
|
|
87e702 |
|
|
|
87e702 |
diff --git a/src/utils/xtotroff/xtotroff.c b/src/utils/xtotroff/xtotroff.c
|
|
|
87e702 |
index 8545a5e..aee2a1a 100644
|
|
|
87e702 |
--- a/src/utils/xtotroff/xtotroff.c
|
|
|
87e702 |
+++ b/src/utils/xtotroff/xtotroff.c
|
|
|
87e702 |
@@ -127,7 +127,9 @@ static int MapFont(char *font_name, const char *troff_name)
|
|
|
87e702 |
XFontName parsed;
|
|
|
87e702 |
int j, k;
|
|
|
87e702 |
DviCharNameMap *char_map;
|
|
|
87e702 |
- char encoding[256];
|
|
|
87e702 |
+ /* 'encoding' needs to hold a CharSetRegistry (256), a CharSetEncoding
|
|
|
87e702 |
+ (256) [both from XFontName.h], a dash, and a null terminator. */
|
|
|
87e702 |
+ char encoding[256 * 2 + 1 + 1];
|
|
|
87e702 |
char *s;
|
|
|
87e702 |
int wid;
|
|
|
87e702 |
char name_string[2048];
|
|
|
87e702 |
@@ -156,7 +158,8 @@ static int MapFont(char *font_name, const char *troff_name)
|
|
|
87e702 |
return 0;
|
|
|
87e702 |
|
|
|
87e702 |
XParseFontName(names[0], &parsed, &attributes);
|
|
|
87e702 |
- sprintf(encoding, "%s-%s", parsed.CharSetRegistry,
|
|
|
87e702 |
+ size_t sz = sizeof encoding;
|
|
|
87e702 |
+ snprintf(encoding, sz, "%s-%s", parsed.CharSetRegistry,
|
|
|
87e702 |
parsed.CharSetEncoding);
|
|
|
87e702 |
for (s = encoding; *s; s++)
|
|
|
87e702 |
if (isupper(*s))
|
|
|
87e702 |
--
|
|
|
87e702 |
2.32.0
|
|
|
87e702 |
|