strncat parameter audit. Unfortunatly, strncat is counter-intutite: the n in

strncat is not the maximum length of the destination string, but of the SOURCE
string, thus strncat (dest, src, sizeof (dest)) is incorrect. It should be
strncat (dest, src, sizeof (text) - strlen (dest)). Even then, no terminating
nul will be written if src is too long, but at least it won't crash the stack:)
This commit is contained in:
Bill Currie 2000-12-05 16:04:12 +00:00
parent 66e0e31b57
commit eae11661e4
19 changed files with 54 additions and 53 deletions

View file

@ -620,10 +620,10 @@ void Con_DrawConsole (int lines)
y = x - i - 11;
strncpy(dlbar, text, i);
dlbar[i] = 0;
strncat (dlbar, "...", sizeof(dlbar));
strncat (dlbar, "...", sizeof(dlbar) - strlen (dlbar));
} else
strcpy(dlbar, text);
strncat (dlbar, ": ", sizeof(dlbar));
strncpy(dlbar, text, sizeof (dlbar));
strncat (dlbar, ": ", sizeof(dlbar) - strlen (dlbar));
i = strlen(dlbar);
dlbar[i++] = '\x80';
// where's the dot go?