From 413f9e46eb73e5ebec9a05b5669df8b927126596 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bal=C3=A1zs=20Dura-Kov=C3=A1cs?= Date: Thu, 18 Aug 2022 17:44:41 +0200 Subject: [PATCH] Fix out-of-bounds write Closes https://github.com/mate-desktop/pluma/issues/664 The size of tempfont was one byte too short, so strcpy performed an out-of-bounds write of the terminating 0. --- pluma/pluma-window.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pluma/pluma-window.c b/pluma/pluma-window.c index b86c0b6..a8e4be8 100644 --- a/pluma/pluma-window.c +++ b/pluma/pluma-window.c @@ -328,7 +328,7 @@ pluma_window_key_press_event (GtkWidget *widget, g_strcanon (tempsize, "1234567890", '\0'); g_strreverse (tempsize); - gchar tempfont [strlen (font)]; + gchar tempfont [strlen (font) + 1]; strcpy (tempfont, font); tempfont [strlen (font) - strlen (tempsize)] = 0; -- 2.39.2