From 3cb51b948afb92db1804bb557eac83f3c2572d32 Mon Sep 17 00:00:00 2001 From: "Lubomir I. Ivanov" Date: Mon, 11 Feb 2013 01:49:22 +0200 Subject: print.c: Fix more buffer lengths print.c has a lot of defined buffer sizes, which do not consider UTF-8 expansion. gettext() with UTF-8 can inflate a string up to 2x the length (with 2byte characters). So if you set a buffer with length, say 20 bytes, lets see what happens: divenr[20]; snprintf(divenr, sizeof(divenr), _("Dive #%d - "), dive->number); But wait, in Russian "Dive" (which in latin text is "Pogrugenie") ends up with 10 cyrilic characters (20 bytes), so there is already buffer overflow here and snprintf() kicks in to corrupt the string. In matters of truncation snprintf() isn't UTF-8 safe. So if the buffer size happens to be less of the requested string to be put in there, the truncation can corrupt a trailing unicode character. For now, lets try fixing these by expanding the buffer sizes. Signed-off-by: Lubomir I. Ivanov Signed-off-by: Dirk Hohndel --- print.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/print.c b/print.c index a50091399..26c93fd28 100644 --- a/print.c +++ b/print.c @@ -63,7 +63,7 @@ static void show_dive_header(struct dive *dive, cairo_t *cr, double w, PangoLayout *layout; PangoRectangle ink_ext, logic_ext; struct tm tm; - char buffer[160], divenr[20], *people; + char buffer[160], divenr[40], *people; maxwidth = w * PANGO_SCALE; maxheight = h * PANGO_SCALE * 0.9; @@ -157,7 +157,7 @@ static void show_dive_notes(struct dive *dive, cairo_t *cr, double w, /* Print the used gas mix */ static void print_ean_trimix (cairo_t *cr, PangoLayout *layout, int O2, int He){ - char buffer[8]; + char buffer[64]; if (He){ snprintf(buffer, sizeof(buffer), "Tx%d/%d", O2, He); @@ -335,7 +335,7 @@ static void print_weight_data (struct dive *dive, cairo_t *cr, int maxwidth, int /* Print the dive OTUs */ static void print_otus (struct dive *dive, cairo_t *cr, PangoLayout *layout, int maxwidth) { - char buffer[20]; + char buffer[40]; cairo_move_to (cr,(maxwidth*0.05) / ((double) PANGO_SCALE), 0); snprintf(buffer, sizeof(buffer), _("OTU")); @@ -350,7 +350,7 @@ static void print_otus (struct dive *dive, cairo_t *cr, PangoLayout *layout, int /* Print the dive maxCNS */ static void print_cns (struct dive *dive, cairo_t *cr, PangoLayout *layout, int maxwidth) { - char buffer[20]; + char buffer[40]; cairo_move_to (cr,(maxwidth*0.05) / ((double) PANGO_SCALE), 0); @@ -369,7 +369,7 @@ static void print_SAC (struct dive *dive, cairo_t *cr, PangoLayout *layout, int double sac; int decimals; const char *unit; - char buffer[20]; + char buffer[40]; cairo_move_to (cr,(maxwidth*0.05) / ((double) PANGO_SCALE), 0); snprintf(buffer, sizeof(buffer), _("SAC")); @@ -524,7 +524,7 @@ static void show_dive_table(struct dive *dive, cairo_t *cr, double w, double maxwidth, maxheight, colwidth, curwidth; PangoLayout *layout; struct tm tm; - char buffer[160], divenr[20]; + char buffer[160], divenr[40]; maxwidth = w * PANGO_SCALE; maxheight = h * PANGO_SCALE * 0.9; -- cgit v1.2.3-70-g09d2