The local lbuf can potentially be left not nul-terminated,
and the tab expension can potentially write out-of-bound.

Signed-off-by: Jules Maselbas <jmasel...@zdiv.net>
---
 commands/edit.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/commands/edit.c b/commands/edit.c
index fcf8ad90f5..3bbe60fdbf 100644
--- a/commands/edit.c
+++ b/commands/edit.c
@@ -53,14 +53,14 @@ static char *screenline(char *line, int *pos)
                return lbuf;
        }
 
-       for (i = 0; outpos < 1024; i++) {
+       for (i = 0; outpos < sizeof(lbuf) - 1; i++) {
                if (i == textx && pos)
                        *pos = outpos;
                if (!line[i])
                        break;
                if (line[i] == '\t') {
                        lbuf[outpos++] = ' ';
-                       while (outpos % TABSPACE)
+                       while (outpos < sizeof(lbuf) - 1 && outpos % TABSPACE)
                                lbuf[outpos++] = ' ';
                        continue;
                }
-- 
2.48.1


Reply via email to