From 5e6a1fed781eb5e31ff7d2c3446839ec8a3c5072 Mon Sep 17 00:00:00 2001 From: Dmitry Podgorny Date: Fri, 16 Nov 2012 13:44:15 +0200 Subject: [PATCH 1/3] _cmd_tiny: fix allocation for usage variable --- src/command.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/command.c b/src/command.c index 609b3817..b9c77b10 100644 --- a/src/command.c +++ b/src/command.c @@ -1301,7 +1301,7 @@ _cmd_tiny(const char * const inp, struct cmd_help_t help) if (args == NULL) { cons_show("Usage: %s", help.usage); if (win_in_chat()) { - char usage[strlen(help.usage + 8)]; + char usage[strlen(help.usage) + 8]; sprintf(usage, "Usage: %s", help.usage); win_show(usage); } From d234a7177000cea7cbd1a86350a963762852aecf Mon Sep 17 00:00:00 2001 From: Dmitry Podgorny Date: Fri, 16 Nov 2012 13:49:26 +0200 Subject: [PATCH 2/3] _cmd_set_boolean_preference: fix usage allocation --- src/command.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/command.c b/src/command.c index b9c77b10..a02c77e9 100644 --- a/src/command.c +++ b/src/command.c @@ -1660,7 +1660,7 @@ _cmd_set_boolean_preference(const char * const inp, struct cmd_help_t help, cons_show(disabled->str); set_func(FALSE); } else { - char usage[strlen(help.usage + 8)]; + char usage[strlen(help.usage) + 8]; sprintf(usage, "Usage: %s", help.usage); cons_show(usage); } From 52751d16aac48cc9264256d6bfb6253162cd80af Mon Sep 17 00:00:00 2001 From: Dmitry Podgorny Date: Fri, 16 Nov 2012 14:07:31 +0200 Subject: [PATCH 3/3] _win_notify_remind: fix possible buffer overflow fix buffer overflow when 'unread' is greater than 999 --- src/windows.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/windows.c b/src/windows.c index 5c86a90f..ebf57d6d 100644 --- a/src/windows.c +++ b/src/windows.c @@ -567,7 +567,7 @@ _win_notify_remind(gint unread) if (unread == 1) { sprintf(message, "1 unread message"); } else { - sprintf(message, "%d unread messages", unread); + snprintf(message, sizeof(message), "%d unread messages", unread); } _win_notify(message, 5000, "Incoming message");