The 'argv' strings passed into strjoinsplit are concatenated and
stored within the 'buff' array on the stack. Although we are
careful to ensure there is enough room remaining to store *argv
and a separating ' ' character before performing strcat, we also
need to ensure that there's room for the null terminator that
strcat itself will append.
Signed-off-by: Jason Gerecke <killert...@gmail.com>
---
tools/xsetwacom.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/xsetwacom.c b/tools/xsetwacom.c
index 805fba9..9c0f65b 100644
--- a/tools/xsetwacom.c
+++ b/tools/xsetwacom.c
@@ -1197,7 +1197,7 @@ static char** strjoinsplit(int argc, char **argv, int
*nwords)
while(argc--)
{
- if (strlen(buff) + strlen(*argv) + 1 >= sizeof(buff))
+ if (strlen(buff) + strlen(*argv) + 2 >= sizeof(buff))
break;
strcat(buff, *argv);
--
2.1.0
------------------------------------------------------------------------------
Want excitement?
Manually upgrade your production database.
When you want reliability, choose Perforce
Perforce version control. Predictably reliable.
http://pubads.g.doubleclick.net/gampad/clk?id=157508191&iu=/4140/ostg.clktrk
_______________________________________________
Linuxwacom-devel mailing list
Linuxwacom-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linuxwacom-devel
