Attachment 45236 Details for Bug 102961

[patch] the other attachment

gaim_oldstatus_aim_away_message_substitution_buffer_overflow_fix.diff (text/plain), 1.83 KB, created by Sebastian Krahmer on 2005-08-09 09:13:36 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Sebastian Krahmer

Created: 2005-08-09 09:13:36 UTC

Size: 1.83 KB

patch

obsolete

>Index: src/util.c
>===================================================================
>RCS file: /cvsroot/gaim/gaim/src/util.c,v
>retrieving revision 1.325.2.25
>diff -u -d -p -u -d -p -r1.325.2.25 util.c
>--- src/util.c	31 Jul 2005 15:21:01 -0000	1.325.2.25
>+++ src/util.c	8 Aug 2005 02:48:15 -0000
>@@ -2141,8 +2141,7 @@ gchar *
> gaim_str_sub_away_formatters(const char *str, const char *name)
> {
> 	char *c;
>-	gchar *cpy;
>-	int cnt = 0;
>+	GString *cpy;
> 	time_t t;
> 	struct tm *tme;
> 	char tmp[20];
>@@ -2150,12 +2149,12 @@ gaim_str_sub_away_formatters(const char 
> 	g_return_val_if_fail(str  != NULL, NULL);
> 	g_return_val_if_fail(name != NULL, NULL);
> 
>-	cpy = g_malloc(BUF_LONG);
>+	/* Create an empty GString that is hopefully big enough for most messages */
>+	cpy = g_string_sized_new(1024);
> 
> 	t = time(NULL);
> 	tme = localtime(&t);
> 
>-	cpy[0] = '\0';
> 	c = (char *)str;
> 	while (*c) {
> 		switch (*c) {
>@@ -2164,39 +2163,35 @@ gaim_str_sub_away_formatters(const char 
> 				switch (*(c + 1)) {
> 				case 'n':
> 					/* append name */
>-					strcpy(cpy + cnt, name);
>-					cnt += strlen(name);
>+					g_string_append(cpy, name);
> 					c++;
> 					break;
> 				case 'd':
> 					/* append date */
> 					strftime(tmp, 20, "%m/%d/%Y", tme);
>-					strcpy(cpy + cnt, tmp);
>-					cnt += strlen(tmp);
>+					g_string_append(cpy, tmp);
> 					c++;
> 					break;
> 				case 't':
> 					/* append time */
> 					strftime(tmp, 20, "%I:%M:%S %p", tme);
>-					strcpy(cpy + cnt, tmp);
>-					cnt += strlen(tmp);
>+					g_string_append(cpy, tmp);
> 					c++;
> 					break;
> 				default:
>-					cpy[cnt++] = *c;
>+					g_string_append_c(cpy, *c);
> 				}
> 			} else {
>-				cpy[cnt++] = *c;
>+				g_string_append_c(cpy, *c);
> 			}
> 			break;
> 		default:
>-			cpy[cnt++] = *c;
>+			g_string_append_c(cpy, *c);
> 		}
> 		c++;
> 	}
>-	cpy[cnt] = '\0';
> 
>-	return cpy;
>+	return g_string_free(cpy, FALSE);
> }
> 
> gchar *

Actions: View | Diff

Attachments on bug 102961: 45235 | 45236 | 45469 | 45470