Don't overflow the buffer when buffer would overflow.

The code was taking the pointer size rather than the length of the
string when strcpy:ing into the buffer.
This commit is contained in:
John Axel Eriksson 2018-10-17 15:55:06 +02:00
parent 434cbaabf0
commit 4dd76b7d1e
No known key found for this signature in database
GPG key ID: 04ED6F42C62F42E9

View file

@ -92,7 +92,7 @@ void get_text_size(cairo_t *cairo, const char *font, int *width, int *height,
va_list args;
va_start(args, fmt);
if (vsnprintf(buf, sizeof(buf), fmt, args) >= max_chars) {
strcpy(&buf[sizeof(buf) - sizeof(overflow)], overflow);
strcpy(&buf[sizeof(buf) - strlen(overflow) - 1], overflow);
}
va_end(args);
@ -112,7 +112,7 @@ void pango_printf(cairo_t *cairo, const char *font,
va_list args;
va_start(args, fmt);
if (vsnprintf(buf, sizeof(buf), fmt, args) >= max_chars) {
strcpy(&buf[sizeof(buf) - sizeof(overflow)], overflow);
strcpy(&buf[sizeof(buf) - strlen(overflow) - 1], overflow);
}
va_end(args);