summaryrefslogtreecommitdiffstats
path: root/print.c
diff options
context:
space:
mode:
authorGravatar Dirk Hohndel <dirk@hohndel.org>2013-03-03 17:53:43 -0800
committerGravatar Dirk Hohndel <dirk@hohndel.org>2013-03-03 20:18:23 -0800
commit01291929582ac573d7efd7fba3dbe061c9d70f9a (patch)
treecc836d5c2e40d26dd8f39dd5bad6c5193f2ef04d /print.c
parent93eeb03d67baac26da4153a163bf35567b106524 (diff)
downloadsubsurface-01291929582ac573d7efd7fba3dbe061c9d70f9a.tar.gz
Try to capture some more potential buffer overflows caused by localization
A couple of these could clearly cause a crash just like the one fixed by commit 00865f5a1e1a ("equipment.c: Fix potential buffer overflow in size_data_funct()"). One would append user input to fixed length buffer without checking. We were hardcoding the (correct) max path length in macos.c - replaced by the actual OS constant. But the vast majority are just extremely generous guesses how long localized strings could possibly be. Yes, this commit is likely leaning towards overkill. But we have now been bitten by buffer overflow crashes twice that were caused by localization, so I tried to go through all of the code and identify every possible buffer that could be affected by this. Signed-off-by: Dirk Hohndel <dirk@hohndel.org>
Diffstat (limited to 'print.c')
-rw-r--r--print.c8
1 files changed, 4 insertions, 4 deletions
diff --git a/print.c b/print.c
index ebb80eb2d..d7b6d44aa 100644
--- a/print.c
+++ b/print.c
@@ -69,7 +69,7 @@ static void show_dive_header(struct dive *dive, cairo_t *cr, double w,
PangoLayout *layout;
PangoRectangle ink_ext, logic_ext;
struct tm tm;
- char buffer[160], divenr[40], *people;
+ char buffer[512], divenr[80], *people;
maxwidth = w * PANGO_SCALE;
maxheight = h * PANGO_SCALE * 0.9;
@@ -355,7 +355,7 @@ static void print_weight_data (struct dive *dive, cairo_t *cr, int maxwidth, int
/* Print the dive OTUs */
static void print_otus (struct dive *dive, cairo_t *cr, PangoLayout *layout, int maxwidth)
{
- char buffer[40];
+ char buffer[128];
cairo_move_to (cr,(maxwidth*0.05) / ((double) PANGO_SCALE), 0);
snprintf(buffer, sizeof(buffer), _("OTU"));
@@ -370,7 +370,7 @@ static void print_otus (struct dive *dive, cairo_t *cr, PangoLayout *layout, int
/* Print the dive maxCNS */
static void print_cns (struct dive *dive, cairo_t *cr, PangoLayout *layout, int maxwidth)
{
- char buffer[40];
+ char buffer[128];
cairo_move_to (cr,(maxwidth*0.05) / ((double) PANGO_SCALE), 0);
@@ -389,7 +389,7 @@ static void print_SAC (struct dive *dive, cairo_t *cr, PangoLayout *layout, int
double sac;
int decimals;
const char *unit;
- char buffer[40];
+ char buffer[128];
cairo_move_to (cr,(maxwidth*0.05) / ((double) PANGO_SCALE), 0);
snprintf(buffer, sizeof(buffer), _("SAC"));