luke
/
ngspice
mirror of https://git.code.sf.net/p/ngspice/ngspice
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

src/frontend/plotting/plotit.c, plotit(), fix command line buffer overflow

This commit is contained in:
rlar 2014-11-30 22:15:37 +01:00
parent d18d2a935c
commit 45cfdde701
1 changed files with 10 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
src/frontend/plotting/plotit.c
View File

@ -234,8 +234,8 @@ plotit(wordlist *wl, char *hcopy, char *devname)
char *xn;
int i, j, xt;
double tt;
wordlist *wwl;
char cline[BSIZE_SP], buf[BSIZE_SP], *pname;
wordlist *wwl, *tail;
char *cline = NULL, buf[BSIZE_SP], *pname;
char *nxlabel = NULL, *nylabel = NULL, *ntitle = NULL;
double tstep, tstart, tstop, ttime;
@ -269,24 +269,27 @@ plotit(wordlist *wl, char *hcopy, char *devname)
nylabel = getword(wwl, "ylabel");
ntitle = getword(wwl, "title");
pname = wl_flatten(wwl->wl_next);
(void) sprintf(cline, "plot %s", pname);
tail = wl_cons(tprintf("plot %s", pname), NULL);
tfree(pname);
wl_free(wwl);
/* add title, xlabel or ylabel, if available, with quotes '' */
if (nxlabel) {
sprintf(cline, "%s xlabel '%s'", cline, nxlabel);
tail = wl_cons(tprintf("xlabel '%s'", nxlabel), tail);
tfree(nxlabel);
}
if (nylabel) {
sprintf(cline, "%s ylabel '%s'", cline, nylabel);
tail = wl_cons(tprintf("ylabel '%s'", nylabel), tail);
tfree(nylabel);
}
if (ntitle) {
sprintf(cline, "%s title '%s'", cline, ntitle);
tail = wl_cons(tprintf("title '%s'", ntitle), tail);
tfree(ntitle);
}
cline = wl_flatten(wl_reverse(tail));
wl_free(tail);
/* Now extract all the parameters. */
sameflag = getflag(wl, "samep");
@ -1030,6 +1033,7 @@ plotit(wordlist *wl, char *hcopy, char *devname)
rtn = TRUE;
quit:
tfree(cline);
free_pnode(names);
FREE(title);
quit1: