diff options
| author | Stanislav Malyshev <stas@php.net> | 2000-08-14 11:07:28 +0000 |
|---|---|---|
| committer | Stanislav Malyshev <stas@php.net> | 2000-08-14 11:07:28 +0000 |
| commit | 821042278eb04b5f0baf50357d3a928debccec3c (patch) | |
| tree | 76b5278671e63a179c27fb3250fa08c9ef65a1e7 | |
| parent | 97c200b170976fd686c55511a897658b8d0e25f6 (diff) | |
| download | php-git-821042278eb04b5f0baf50357d3a928debccec3c.tar.gz | |
Fix another crash with long formats (#6145)
# From strncpy manual:
# In the case where the length of src is less than that of
# n, the remainder of dest will be padded with nulls.
| -rw-r--r-- | ext/standard/formatted_print.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/ext/standard/formatted_print.c b/ext/standard/formatted_print.c index 1db9451928..2846eaaa98 100644 --- a/ext/standard/formatted_print.c +++ b/ext/standard/formatted_print.c @@ -184,7 +184,7 @@ php_sprintf_appendstring(char **buffer, int *pos, int *size, char *add, } } PRINTF_DEBUG(("sprintf: appending \"%s\"\n", add)); - strncpy(&(*buffer)[*pos], add, max_width); + strncpy(&(*buffer)[*pos], add, max_width-*pos+1); *pos += MIN(max_width, len); if (alignment == ALIGN_LEFT) { while (npad--) { |