slstatus

Fork of suckless' slstatus with my personal patches
git clone https://git.instinctive.eu/slstatus.git
Log | Files | Refs | README | LICENSE

commit 94a62b864b56d8bad1fb68925dcee7c71015bc54
parent 1d257999ed6049dce4d1305c4dc3304ea9910ca7
Author: Ali H. Fardan <raiz@firemail.cc>
Date:   Sun, 28 Aug 2016 18:19:53 +0300

worked around the buffer overrun in smprintf()

Diffstat:
Mslstatus.c | 9+++++----
1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/slstatus.c b/slstatus.c @@ -78,14 +78,15 @@ setstatus(const char *str) static char * smprintf(const char *fmt, ...) { - /* FIXME: This code should have - bound checks, it is vulnerable to - buffer overflows */ va_list ap; + char tmp[120]; char *ret = NULL; va_start(ap, fmt); - if (vasprintf(&ret, fmt, ap) < 0) + vsnprintf(tmp, sizeof(tmp)-1, fmt, ap); + tmp[strlen(tmp)+1] = '\0'; + + if (asprintf(&ret, "%s", tmp) < 0) return NULL; va_end(ap);