diff options
| author | Balázs Dura-Kovács <[email protected]> | 2022-08-18 17:44:41 +0200 |
|---|---|---|
| committer | ssystems-wulbrich <[email protected]> | 2023-02-27 01:06:48 +0100 |
| commit | 8ca37beb259f7a62fef2005e888248ec880e44cd (patch) | |
| tree | 06aab73e4b1a93e28509a62929bc0eb4f669c44f | |
| parent | e1d9f852ab4f9b1c162385f5aac1b598f563b17a (diff) | |
| download | pluma-8ca37beb259f7a62fef2005e888248ec880e44cd.tar.bz2 pluma-8ca37beb259f7a62fef2005e888248ec880e44cd.tar.xz | |
Fix out-of-bounds write
Closes https://github.com/mate-desktop/pluma/issues/664
The size of tempfont was one byte too short, so strcpy performed an out-of-bounds write of the terminating 0.
| -rw-r--r-- | pluma/pluma-window.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/pluma/pluma-window.c b/pluma/pluma-window.c index 1ca50ec9..f31288d2 100644 --- a/pluma/pluma-window.c +++ b/pluma/pluma-window.c @@ -318,7 +318,7 @@ pluma_window_key_press_event (GtkWidget *widget, g_strcanon (tempsize, "1234567890", '\0'); g_strreverse (tempsize); - gchar tempfont [strlen (font)]; + gchar tempfont [strlen (font) + 1]; strcpy (tempfont, font); tempfont [strlen (font) - strlen (tempsize)] = 0; |