From 7b6c9f14c0934081e48c1d5b024040e6f87bc365 Mon Sep 17 00:00:00 2001 From: "jan.nijtmans" Date: Mon, 28 Mar 2011 09:16:53 +0000 Subject: [Bug 3129527]: Fix buffer overflow w/ GCC 4.5 and -D_FORTIFY_SOURCE=2. One more place where this problem could appear. --- ChangeLog | 5 +++++ generic/tkTextBTree.c | 12 +++++++----- 2 files changed, 12 insertions(+), 5 deletions(-) diff --git a/ChangeLog b/ChangeLog index 3fca135..3b0ab53 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,8 @@ +2011-03-28 Jan Nijtmans + + * generic/tkTextBTree.c: [Bug 3129527]: Fix buffer overflow w/ GCC 4.5 and + -D_FORTIFY_SOURCE=2. One more place where this problem could appear. + 2011-03-24 Jan Nijtmans * win/tkWinMenu.c: [Bug #3239768] tk8.4.19 (and later) WIN32 diff --git a/generic/tkTextBTree.c b/generic/tkTextBTree.c index c2a5fbd..f488038 100644 --- a/generic/tkTextBTree.c +++ b/generic/tkTextBTree.c @@ -444,7 +444,7 @@ TkBTreeInsertChars(indexPtr, string) curPtr->nextPtr = segPtr; } segPtr->size = chunkSize; - strncpy(segPtr->body.chars, string, (size_t) chunkSize); + memcpy(segPtr->body.chars, string, (size_t) chunkSize); segPtr->body.chars[chunkSize] = 0; if (eol[-1] != '\n') { @@ -3379,12 +3379,13 @@ CharSplitProc(segPtr, index) newPtr1->typePtr = &tkTextCharType; newPtr1->nextPtr = newPtr2; newPtr1->size = index; - strncpy(newPtr1->body.chars, segPtr->body.chars, (size_t) index); + memcpy(newPtr1->body.chars, segPtr->body.chars, (size_t) index); newPtr1->body.chars[index] = 0; newPtr2->typePtr = &tkTextCharType; newPtr2->nextPtr = segPtr->nextPtr; newPtr2->size = segPtr->size - index; - strcpy(newPtr2->body.chars, segPtr->body.chars + index); + memcpy(newPtr2->body.chars, segPtr->body.chars + index, newPtr2->size); + newPtr2->body.chars[newPtr2->size] = 0; ckfree((char*) segPtr); return newPtr1; } @@ -3426,8 +3427,9 @@ CharCleanupProc(segPtr, linePtr) newPtr->typePtr = &tkTextCharType; newPtr->nextPtr = segPtr2->nextPtr; newPtr->size = segPtr->size + segPtr2->size; - strcpy(newPtr->body.chars, segPtr->body.chars); - strcpy(newPtr->body.chars + segPtr->size, segPtr2->body.chars); + memcpy(newPtr->body.chars, segPtr->body.chars, segPtr->size); + memcpy(newPtr->body.chars + segPtr->size, segPtr2->body.chars, segPtr2->size); + newPtr->body.chars[newPtr->size] = 0; ckfree((char*) segPtr); ckfree((char*) segPtr2); return newPtr; -- cgit v0.12