diff options
author | Daniel Friesel <derf@finalrewind.org> | 2021-07-23 20:25:19 +0200 |
---|---|---|
committer | Daniel Friesel <derf@finalrewind.org> | 2021-07-23 20:25:19 +0200 |
commit | 728334b013c459438d2f92b78931a7c3b6a715c3 (patch) | |
tree | bf7f0bd9a28ead206f63d4146ad61622f5e91abd /src | |
parent | c188578f3f807c967b54b73b793399f0e23f54b3 (diff) |
feh_draw_exif: Fix out of bounds array access when handling long lines
Diffstat (limited to 'src')
-rw-r--r-- | src/imlib.c | 7 |
1 files changed, 3 insertions, 4 deletions
diff --git a/src/imlib.c b/src/imlib.c index 140e487..5970bd2 100644 --- a/src/imlib.c +++ b/src/imlib.c @@ -1178,7 +1178,7 @@ void feh_draw_exif(winwidget w) { /* max 128 lines */ pos2 = 0; - while ( pos2 < 256 ) /* max 256 chars per line */ + while ( pos2 < 255 ) /* max 255 chars + 1 null byte per line */ { if ( (buffer[pos] != '\n') && (buffer[pos] != '\0') ) @@ -1188,19 +1188,18 @@ void feh_draw_exif(winwidget w) else if ( buffer[pos] == '\0' ) { pos = EXIF_MAX_DATA; /* all data seen */ - info_line[pos2] = '\0'; break; } else { - info_line[pos2] = '\0'; /* line finished, continue with next line*/ - pos++; + pos++; /* line finished, continue with next line*/ break; } pos++; pos2++; } + info_line[pos2] = '\0'; gib_imlib_get_text_size(fn, info_line, NULL, &line_width, &line_height, IMLIB_TEXT_TO_RIGHT); |