From 66cf87899fd433e563fb5445fbf92506705bc52c Mon Sep 17 00:00:00 2001 From: stefanjones Date: Fri, 21 May 2004 20:08:12 +0000 Subject: [PATCH] 2004-05-21 Stefan Jones * src/frontend/terminal.c: Fix buffer overflow in out_printf --- ChangeLog | 5 +++++ src/frontend/terminal.c | 14 ++++++++++++-- 2 files changed, 17 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index cc73a49f6..3a0da9d67 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,8 @@ +2004-05-21 Stefan Jones + + * src/frontend/terminal.c: + Fix buffer overflow in out_printf + 2004-05-19 Stefan Jones * src/tclspice.c: diff --git a/src/frontend/terminal.c b/src/frontend/terminal.c index 97254ef00..1db244e3b 100644 --- a/src/frontend/terminal.c +++ b/src/frontend/terminal.c @@ -240,11 +240,21 @@ out_send(char *string) void out_printf(char *fmt, char *s1, char *s2, char *s3, char *s4, char *s5, char *s6, char *s7, char *s8, char *s9, char *s10) { - char buf[MAXLEN]; + char _buf[MAXLEN]; + char *buf=_buf; + int len; - sprintf(buf, fmt, s1, s2, s3, s4, s5, s6, s7, s8, s9, s10); + len = snprintf(buf, MAXLEN, fmt, s1, s2, s3, s4, s5, s6, s7, s8, s9, s10); + + if(len >= MAXLEN) { + buf = MALLOC(len+1); + sprintf(buf, fmt, s1, s2, s3, s4, s5, s6, s7, s8, s9, s10); + } out_send(buf); + + if(len >= MAXLEN) + FREE(buf); return; }