Fix potential buffer overflow - wmenu - 🔧 fork of wmenu
(HTM) git clone git@git.drkhsh.at/wmenu.git
(DIR) Log
(DIR) Files
(DIR) Refs
(DIR) README
(DIR) LICENSE
---
(DIR) commit 7c1e28b201ed52e42ddd8b114fdfbad0720d86d2
(DIR) parent a7df5b270d5aea3a38e7dbc9a27bcfd059b8bc61
(HTM) Author: adnano <me@adnano.co>
Date: Sun, 26 Feb 2023 07:45:37 -0500
Fix potential buffer overflow
Calling strncpy where the size of the string to copy is equal to the
size of the destination can potentially lead to a buffer overflow. To
fix this, copy only what is needed with memcpy, and explicitly terminate
the string with a null character.
Diffstat:
M main.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
---
(DIR) diff --git a/main.c b/main.c
@@ -758,8 +758,9 @@ void keypress(struct menu_state *state, enum wl_keyboard_key_state key_state,
if (!state->selection) {
return;
}
- strncpy(state->text, state->selection->text, sizeof state->text);
- state->cursor = strlen(state->text);
+ state->cursor = strnlen(state->selection->text, sizeof state->text - 1);
+ memcpy(state->text, state->selection->text, state->cursor);
+ state->text[state->cursor] = '\0';
match(state);
render_frame(state);
break;