feh_draw_exif: Fix out of bounds array access when handling long lines

1 files changed, 3 insertions, 4 deletions

diff --git a/src/imlib.c b/src/imlib.c
index 140e487..5970bd2 100644
--- a/src/imlib.c
+++ b/src/imlib.c
@@ -1178,7 +1178,7 @@ void feh_draw_exif(winwidget w)
 		{
 			/* max 128 lines */
 			pos2 = 0;
-			while ( pos2 < 256 ) /* max 256 chars per line */
+			while ( pos2 < 255 ) /* max 255 chars + 1 null byte per line */
 			{
 				if ( (buffer[pos] != '\n')
 				      && (buffer[pos] != '\0') )
@@ -1188,19 +1188,18 @@ void feh_draw_exif(winwidget w)
 				else if ( buffer[pos] == '\0' )
 				{
 					pos = EXIF_MAX_DATA; /* all data seen */
-					info_line[pos2] = '\0';
 					break;
 				}
 				else
 				{
-					info_line[pos2] = '\0'; /* line finished, continue with next line*/
-					pos++;
+					pos++; /* line finished, continue with next line*/
 					break;
 				}
 
 				pos++;
 				pos2++;
 			}
+			info_line[pos2] = '\0';
 
 			gib_imlib_get_text_size(fn, info_line, NULL, &line_width,
                               &line_height, IMLIB_TEXT_TO_RIGHT);