diff options
| author | nijtmans <nijtmans> | 2010-12-06 10:30:49 (GMT) |
|---|---|---|
| committer | nijtmans <nijtmans> | 2010-12-06 10:30:49 (GMT) |
| commit | 145990da784cdcc5cad752ea8a9b6c9d7993a4a5 (patch) | |
| tree | 30f68715fe0ee4a093c81502fb5921d24507a4cf /generic/tkTextDisp.c | |
| parent | cd230a0b288f0edcbccd62710fe5c95261c83b2e (diff) | |
| download | tk-145990da784cdcc5cad752ea8a9b6c9d7993a4a5.zip tk-145990da784cdcc5cad752ea8a9b6c9d7993a4a5.tar.gz tk-145990da784cdcc5cad752ea8a9b6c9d7993a4a5.tar.bz2 | |
[Bug 3129527]: Fix buffer overflow w/ GCC 4.5 and -D_FORTIFY_SOURCE=2
Diffstat (limited to 'generic/tkTextDisp.c')
| -rw-r--r-- | generic/tkTextDisp.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/generic/tkTextDisp.c b/generic/tkTextDisp.c index 9dc4316..849123f 100644 --- a/generic/tkTextDisp.c +++ b/generic/tkTextDisp.c @@ -12,7 +12,7 @@ * See the file "license.terms" for information on usage and redistribution of * this file, and for a DISCLAIMER OF ALL WARRANTIES. * - * RCS: @(#) $Id: tkTextDisp.c,v 1.77 2010/01/07 15:32:18 dkf Exp $ + * RCS: @(#) $Id: tkTextDisp.c,v 1.78 2010/12/06 10:30:49 nijtmans Exp $ */ #include "tkInt.h" @@ -415,8 +415,8 @@ typedef struct TextDInfo { typedef struct CharInfo { int numBytes; /* Number of bytes to display. */ - char chars[4]; /* UTF characters to display. Actual size will - * be numBytes, not 4. THIS MUST BE THE LAST + char chars[1]; /* UTF characters to display. Actual size will + * be numBytes, not 1. THIS MUST BE THE LAST * FIELD IN THE STRUCTURE. */ } CharInfo; @@ -7170,7 +7170,7 @@ TkTextCharLayoutProc( #if !TK_LAYOUT_WITH_BASE_CHUNKS ciPtr = (CharInfo *) - ckalloc((unsigned) bytesThatFit + Tk_Offset(CharInfo, chars) + 1); + ckalloc((unsigned) ((Tk_Offset(CharInfo, chars) + 1) + bytesThatFit)); chunkPtr->clientData = ciPtr; memcpy(ciPtr->chars, p, (unsigned) bytesThatFit); #endif /* TK_LAYOUT_WITH_BASE_CHUNKS */ |