diff options
| author | Balázs Dura-Kovács <[email protected]> | 2022-08-18 17:44:41 +0200 |
|---|---|---|
| committer | Luke from DC <[email protected]> | 2022-08-18 22:58:34 +0000 |
| commit | 413f9e46eb73e5ebec9a05b5669df8b927126596 (patch) | |
| tree | aa2444abefab1b5985fc101d96d7051e7cdb65ab | |
| parent | d99eb16fa11b5a3abeb06f10d8d23cf3ce9ff853 (diff) | |
| download | pluma-413f9e46eb73e5ebec9a05b5669df8b927126596.tar.bz2 pluma-413f9e46eb73e5ebec9a05b5669df8b927126596.tar.xz | |
Fix out-of-bounds write
Closes https://github.com/mate-desktop/pluma/issues/664
The size of tempfont was one byte too short, so strcpy performed an out-of-bounds write of the terminating 0.
| -rw-r--r-- | pluma/pluma-window.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/pluma/pluma-window.c b/pluma/pluma-window.c index b86c0b68..a8e4be81 100644 --- a/pluma/pluma-window.c +++ b/pluma/pluma-window.c @@ -328,7 +328,7 @@ pluma_window_key_press_event (GtkWidget *widget, g_strcanon (tempsize, "1234567890", '\0'); g_strreverse (tempsize); - gchar tempfont [strlen (font)]; + gchar tempfont [strlen (font) + 1]; strcpy (tempfont, font); tempfont [strlen (font) - strlen (tempsize)] = 0; |