diff options
author | Kristian Høgsberg <krh@bitplanet.net> | 2014-01-09 23:39:20 -0800 |
---|---|---|
committer | Kristian Høgsberg <krh@bitplanet.net> | 2014-01-09 23:39:20 -0800 |
commit | a548b4b85cfdbef103f622c3e3aaf976938535f9 (patch) | |
tree | d194aa2988a37a857d062f4322df570b4fe52fb2 /clients/keyboard.c | |
parent | b0fb25dedce8ef13ad04d411b057e6f23b4e991c (diff) | |
download | weston-a548b4b85cfdbef103f622c3e3aaf976938535f9.tar.gz |
keyboard: Fix insert_text() string utility
strncat() into a newly allocated buffer isn't well-defined. I don't know
how this didn't crash all the time, getting blocks from malloc() with
a NUL in the first byte must be fairly common.
Closes: https://bugs.freedesktop.org/show_bug.cgi?id=71750
Diffstat (limited to 'clients/keyboard.c')
-rw-r--r-- | clients/keyboard.c | 11 |
1 files changed, 6 insertions, 5 deletions
diff --git a/clients/keyboard.c b/clients/keyboard.c index e08a5fa6..963382c1 100644 --- a/clients/keyboard.c +++ b/clients/keyboard.c @@ -384,12 +384,13 @@ resize_handler(struct widget *widget, static char * insert_text(const char *text, uint32_t offset, const char *insert) { - char *new_text = xmalloc(strlen(text) + strlen(insert) + 1); + int tlen = strlen(text), ilen = strlen(insert); + char *new_text = xmalloc(tlen + ilen + 1); - strncat(new_text, text, offset); - new_text[offset] = '\0'; - strcat(new_text, insert); - strcat(new_text, text + offset); + memcpy(new_text, text, offset); + memcpy(new_text + offset, insert, ilen); + memcpy(new_text + offset + ilen, text + offset, tlen - offset); + new_text[tlen + ilen] = '\0'; return new_text; } |