diff options
| author | Tobias Stoeckmann <tobias@stoeckmann.org> | 2017-04-02 13:16:50 +0200 |
|---|---|---|
| committer | Tobias Stoeckmann <tobias@stoeckmann.org> | 2017-04-02 13:16:50 +0200 |
| commit | 575b9345c87f22349c948fcc814c301816315a71 (patch) | |
| tree | e67c6d741c3d1d6715812701965cf55944e2d236 | |
| parent | a5e60401f9dce39f7f1bcf53ede508c63f5d2ad3 (diff) | |
Always terminate strncpy results with '\0'.
The strncpy function does not guarantee to end the resulting character
sequence with a terminating nul character if not enough space is
available. This could be triggered by supplying a sufficiently long
output_file option.
Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
| -rw-r--r-- | src/collage.c | 6 | ||||
| -rw-r--r-- | src/index.c | 6 | ||||
| -rw-r--r-- | src/thumbnail.c | 6 |
3 files changed, 12 insertions, 6 deletions
diff --git a/src/collage.c b/src/collage.c index bcb30fa..b975136 100644 --- a/src/collage.c +++ b/src/collage.c @@ -191,8 +191,10 @@ void init_collage_mode(void) char output_buf[1024]; if (opt.output_dir) snprintf(output_buf, 1024, "%s/%s", opt.output_dir, opt.output_file); - else - strncpy(output_buf, opt.output_file, 1024); + else { + strncpy(output_buf, opt.output_file, 1023); + output_buf[1023] = '\0'; + } gib_imlib_save_image(im_main, output_buf); if (opt.verbose) { int tw, th; diff --git a/src/index.c b/src/index.c index a71744d..7a2f5fc 100644 --- a/src/index.c +++ b/src/index.c @@ -324,8 +324,10 @@ void init_index_mode(void) if (opt.output_dir) snprintf(output_buf, 1024, "%s/%s", opt.output_dir, opt.output_file); - else - strncpy(output_buf, opt.output_file, 1024); + else { + strncpy(output_buf, opt.output_file, 1023); + output_buf[1023] = '\0'; + } gib_imlib_save_image_with_error_return(im_main, output_buf, &err); if (err) { diff --git a/src/thumbnail.c b/src/thumbnail.c index c9cc24f..43168c4 100644 --- a/src/thumbnail.c +++ b/src/thumbnail.c @@ -381,8 +381,10 @@ void init_thumbnail_mode(void) if (opt.output_dir) snprintf(output_buf, 1024, "%s/%s", opt.output_dir, opt.output_file); - else - strncpy(output_buf, opt.output_file, 1024); + else { + strncpy(output_buf, opt.output_file, 1023); + output_buf[1023] = '\0'; + } gib_imlib_save_image_with_error_return(td.im_main, output_buf, &err); if (err) { feh_imlib_print_load_error(output_buf, td.im_main, err); |