60 lines
2.2 KiB
Diff
60 lines
2.2 KiB
Diff
From 148437fc418bcfe521f61213cf3917f3992c7088 Mon Sep 17 00:00:00 2001
|
|
From: Josef Moellers <jmoellers@suse.de>
|
|
Date: Thu, 22 Apr 2021 12:02:19 +0200
|
|
Subject: [PATCH] Handle sprintf() appending a NUL byte [issues 53 and 54]
|
|
|
|
---
|
|
caca/codec/export.c | 24 ++++++++++++++----------
|
|
1 file changed, 14 insertions(+), 10 deletions(-)
|
|
|
|
diff --git a/caca/codec/export.c b/caca/codec/export.c
|
|
index 7f7c4422..250ea2b1 100644
|
|
--- a/caca/codec/export.c
|
|
+++ b/caca/codec/export.c
|
|
@@ -944,21 +944,21 @@ static void *export_tga(caca_canvas_t const *cv, size_t *bytes)
|
|
cur = data = malloc(*bytes);
|
|
|
|
/* ID Length */
|
|
- cur += sprintf(cur, "%c", 0);
|
|
+ *cur++ = 0;
|
|
/* Color Map Type: no colormap */
|
|
- cur += sprintf(cur, "%c", 0);
|
|
+ *cur++ = 0;
|
|
/* Image Type: uncompressed truecolor */
|
|
- cur += sprintf(cur, "%c", 2);
|
|
+ *cur++ = 2;
|
|
/* Color Map Specification: no color map */
|
|
memset(cur, 0, 5); cur += 5;
|
|
|
|
/* Image Specification */
|
|
- cur += sprintf(cur, "%c%c", 0, 0); /* X Origin */
|
|
- cur += sprintf(cur, "%c%c", 0, 0); /* Y Origin */
|
|
- cur += sprintf(cur, "%c%c", w & 0xff, w >> 8); /* Width */
|
|
- cur += sprintf(cur, "%c%c", h & 0xff, h >> 8); /* Height */
|
|
- cur += sprintf(cur, "%c", 32); /* Pixel Depth */
|
|
- cur += sprintf(cur, "%c", 40); /* Image Descriptor */
|
|
+ *cur++ = 0; *cur++ = 0; /* X Origin */
|
|
+ *cur++ = 0; *cur++ = 0; /* Y Origin */
|
|
+ *cur++ = w & 0xff; *cur++ = w >> 8; /* Width */
|
|
+ *cur++ = h & 0xff; *cur++ = h >> 8; /* Height */
|
|
+ *cur++ = 32; /* Pixel Depth */
|
|
+ *cur++ = 40; /* Image Descriptor */
|
|
|
|
/* Image ID: no ID */
|
|
/* Color Map Data: no colormap */
|
|
@@ -995,9 +995,13 @@ static void *export_troff(caca_canvas_t const *cv, size_t *bytes)
|
|
* + 4 bytes = 33
|
|
* Each line has a \n (1) and maybe 0xc2 0xa0 (2)
|
|
* Header has .nf\n (3)
|
|
+ * Kludge alert:
|
|
+ * The sprintf functions all append a NUL byte, so
|
|
+ * add one byte for any terminating NUL byte,
|
|
+ * but don't tell the caller.
|
|
*/
|
|
*bytes = 3 + cv->height * 3 + (cv->width * cv->height * 33);
|
|
- cur = data = malloc(*bytes);
|
|
+ cur = data = malloc(*bytes + 1); /* Add space for a terminating NUL byte */
|
|
|
|
cur += sprintf(cur, ".nf\n");
|
|
|