Skip to content

crush in edit()

1 message · Ei-ji Nakama

Original
Ei-ji Nakama
# 
It is a problem by stack smashing protector.
--- src/modules/X11/dataentry.c.orig    2006-09-04 23:41:34.000000000 +0900
+++ src/modules/X11/dataentry.c 2006-10-18 11:31:43.000000000 +0900
@@ -1046,7 +1046,7 @@
            for(j=0;*(wcspc+j)!=L'\0';j++)wcs[j]=*(wcspc+j);
            wcs[j]=L'\0';
            w_p=wcs;
-           cnt=wcsrtombs(s,(const wchar_t **)&w_p,sizeof(wcs),NULL);
+           cnt=wcsrtombs(s,(const wchar_t **)&w_p,sizeof(s)-1,NULL);
            s[cnt]='\0';
             if (textwidth(s, strlen(s)) < (bw - text_offset)) break;
             *(++wcspc) = L'<';
@@ -1056,7 +1056,7 @@
            for(j=0;*(wcspc+j)!=L'\0';j++)wcs[j]=*(wcspc+j);
            wcs[j]=L'\0';
            w_p=wcs;
-           cnt=wcsrtombs(s,(const wchar_t **)&w_p,sizeof(wcs),NULL);
+           cnt=wcsrtombs(s,(const wchar_t **)&w_p,sizeof(s)-1,NULL);
            s[cnt]='\0';
             if (textwidth(s, strlen(s)) < (bw - text_offset)) break;
             *(wcspbuf + i - 2) = L'>';
@@ -1066,7 +1066,7 @@
     for(j=0;*(wcspc+j)!=L'\0';j++) wcs[j]=*(wcspc+j);
     wcs[j]=L'\0';
     w_p=wcs;
-    cnt=wcsrtombs(s,(const wchar_t **)&w_p,sizeof(wcs),NULL);
+    cnt=wcsrtombs(s,(const wchar_t **)&w_p,sizeof(s)-1,NULL);

     drawtext(x_pos + text_offset, y_pos + box_h - text_offset, s, cnt);

@@ -2398,6 +2398,7 @@
     int cnt;
     char last_mbs[8];
     char *mbs;
+    size_t bytes;

     mbs = (str == NULL) ? buf : str;

@@ -2411,8 +2412,8 @@
     if(wcs[0] == L'\0') return 0;

     memset(last_mbs, 0, sizeof(last_mbs));
-    wcrtomb(last_mbs, wcs[cnt-1], &mb_st);
-    return(strlen(last_mbs));
+    bytes=wcrtomb(last_mbs, wcs[cnt-1], &mb_st); /* -Wall */
+    return(bytes);
 #else
     return(1);
 #endif


2006/10/18, crazybuddy Vincent <crazyvincent at gmail.com>: