diff options
| author | nijtmans <nijtmans> | 2010-12-06 10:30:49 (GMT) |
|---|---|---|
| committer | nijtmans <nijtmans> | 2010-12-06 10:30:49 (GMT) |
| commit | 145990da784cdcc5cad752ea8a9b6c9d7993a4a5 (patch) | |
| tree | 30f68715fe0ee4a093c81502fb5921d24507a4cf /generic | |
| parent | cd230a0b288f0edcbccd62710fe5c95261c83b2e (diff) | |
| download | tk-145990da784cdcc5cad752ea8a9b6c9d7993a4a5.zip tk-145990da784cdcc5cad752ea8a9b6c9d7993a4a5.tar.gz tk-145990da784cdcc5cad752ea8a9b6c9d7993a4a5.tar.bz2 | |
[Bug 3129527]: Fix buffer overflow w/ GCC 4.5 and -D_FORTIFY_SOURCE=2
Diffstat (limited to 'generic')
| -rw-r--r-- | generic/tkSelect.c | 8 | ||||
| -rw-r--r-- | generic/tkTextDisp.c | 8 |
2 files changed, 8 insertions, 8 deletions
diff --git a/generic/tkSelect.c b/generic/tkSelect.c index beebe12..6077754 100644 --- a/generic/tkSelect.c +++ b/generic/tkSelect.c @@ -10,7 +10,7 @@ * See the file "license.terms" for information on usage and redistribution of * this file, and for a DISCLAIMER OF ALL WARRANTIES. * - * RCS: @(#) $Id: tkSelect.c,v 1.32 2010/11/29 09:07:13 nijtmans Exp $ + * RCS: @(#) $Id: tkSelect.c,v 1.33 2010/12/06 10:30:49 nijtmans Exp $ */ #include "tkInt.h" @@ -30,7 +30,7 @@ typedef struct { * chunk. */ char buffer[TCL_UTF_MAX]; /* A buffer to hold part of a UTF character * that is split across chunks. */ - char command[4]; /* Command to invoke. Actual space is + char command[1]; /* Command to invoke. Actual space is * allocated as large as necessary. This must * be the last entry in the structure. */ } CommandInfo; @@ -902,13 +902,13 @@ Tk_SelectionObjCmd( Tk_DeleteSelHandler(tkwin, selection, target); } else { cmdInfoPtr = (CommandInfo *) ckalloc((unsigned) ( - sizeof(CommandInfo) - 3 + cmdLength)); + (Tk_Offset(CommandInfo, command) + 1) + cmdLength)); cmdInfoPtr->interp = interp; cmdInfoPtr->charOffset = 0; cmdInfoPtr->byteOffset = 0; cmdInfoPtr->buffer[0] = '\0'; cmdInfoPtr->cmdLength = cmdLength; - strcpy(cmdInfoPtr->command, string); + memcpy(cmdInfoPtr->command, string, cmdLength + 1); Tk_CreateSelHandler(tkwin, selection, target, HandleTclCommand, cmdInfoPtr, format); } diff --git a/generic/tkTextDisp.c b/generic/tkTextDisp.c index 9dc4316..849123f 100644 --- a/generic/tkTextDisp.c +++ b/generic/tkTextDisp.c @@ -12,7 +12,7 @@ * See the file "license.terms" for information on usage and redistribution of * this file, and for a DISCLAIMER OF ALL WARRANTIES. * - * RCS: @(#) $Id: tkTextDisp.c,v 1.77 2010/01/07 15:32:18 dkf Exp $ + * RCS: @(#) $Id: tkTextDisp.c,v 1.78 2010/12/06 10:30:49 nijtmans Exp $ */ #include "tkInt.h" @@ -415,8 +415,8 @@ typedef struct TextDInfo { typedef struct CharInfo { int numBytes; /* Number of bytes to display. */ - char chars[4]; /* UTF characters to display. Actual size will - * be numBytes, not 4. THIS MUST BE THE LAST + char chars[1]; /* UTF characters to display. Actual size will + * be numBytes, not 1. THIS MUST BE THE LAST * FIELD IN THE STRUCTURE. */ } CharInfo; @@ -7170,7 +7170,7 @@ TkTextCharLayoutProc( #if !TK_LAYOUT_WITH_BASE_CHUNKS ciPtr = (CharInfo *) - ckalloc((unsigned) bytesThatFit + Tk_Offset(CharInfo, chars) + 1); + ckalloc((unsigned) ((Tk_Offset(CharInfo, chars) + 1) + bytesThatFit)); chunkPtr->clientData = ciPtr; memcpy(ciPtr->chars, p, (unsigned) bytesThatFit); #endif /* TK_LAYOUT_WITH_BASE_CHUNKS */ |