[patch] out-of-bounds-fix-patch

1.26-Fix-out-of-bounds-write.patch (text/plain), 964 bytes, created by Alexander van der Meij on 2023-04-05 08:20:28 UTC

From 413f9e46eb73e5ebec9a05b5669df8b927126596 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bal=C3=A1zs=20Dura-Kov=C3=A1cs?= <[e-mail]>
Date: Thu, 18 Aug 2022 17:44:41 +0200
Subject: [PATCH] Fix out-of-bounds write

Closes https://github.com/mate-desktop/pluma/issues/664

The size of tempfont was one byte too short, so strcpy performed an out-of-bounds write of the terminating 0.
---
 pluma/pluma-window.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pluma/pluma-window.c b/pluma/pluma-window.c
index b86c0b6..a8e4be8 100644
--- a/pluma/pluma-window.c
+++ b/pluma/pluma-window.c
@@ -328,7 +328,7 @@ pluma_window_key_press_event (GtkWidget   *widget,
         g_strcanon (tempsize, "1234567890", '\0');
         g_strreverse (tempsize);
 
-        gchar tempfont [strlen (font)];
+        gchar tempfont [strlen (font) + 1];
         strcpy (tempfont, font);
         tempfont [strlen (font) - strlen (tempsize)] = 0;
 
-- 
2.39.2