From d3275f49374d258c6962d101321b218fc70fec89 Mon Sep 17 00:00:00 2001 From: Daniel Friesel Date: Sun, 11 May 2014 13:48:48 +0200 Subject: feh_printf: Fix buffer overflow when handling unknown format specifiers --- ChangeLog | 3 +++ src/slideshow.c | 3 ++- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 0a441c9..16b0c0f 100644 --- a/ChangeLog +++ b/ChangeLog @@ -10,6 +10,9 @@ git HEAD in it, and as I do not have the time to take over giblib development, importing the library seems to be the best solution. * Fix/improve --randomize for short filelists (closes #151) + * Fix a buffer overflow in the printf implementation when handling unknown + format specifiers (affects --action, --customlist, --index-info, --info, + --thumb-title and --title) Sun, 27 Apr 2014 20:28:02 +0200 Daniel Friesel diff --git a/src/slideshow.c b/src/slideshow.c index 8aa783c..a18c1f8 100644 --- a/src/slideshow.c +++ b/src/slideshow.c @@ -584,7 +584,8 @@ char *feh_printf(char *str, feh_file * file, winwidget winwid) break; default: weprintf("Unrecognized format specifier %%%c", *c); - strncat(ret, c - 1, 2); + if ((strlen(ret) + 3) < sizeof(ret)) + strncat(ret, c - 1, 2); break; } } else if ((*c == '\\') && (*(c+1) != '\0') && ((strlen(ret) + 3) < sizeof(ret))) { -- cgit v1.2.3