Menu

#2 buffer overflow in pic_pie.c

open
nobody
None
5
2009-11-26
2009-11-26
No

The patch below fixes a buffer overflow if percent == 100
See https://bugzilla.novell.com/show_bug.cgi?id=517602 for details (partly german, ask for a translation if needed)

diff -u -p -r -u modlogan-0.8.13_ORIG//src/output/modlogan/pic_pie.c modlogan-0.8.13/src/output/modlogan/pic_pie.c
--- modlogan-0.8.13_ORIG//src/output/modlogan/pic_pie.c 2004-03-18 02:29:43.000000000 +0100
+++ modlogan-0.8.13/src/output/modlogan/pic_pie.c 2009-11-16 13:18:57.000000000 +0100
@@ -222,7 +222,7 @@ int mplugin_modlogan_create_pie(mconfig
oldx2 = x2;
oldy2 = y2;

- sprintf(numstr, "%%2d%%%% %%.%ds", IM_TEXT_LEN-5);
+ sprintf(numstr, "%%2d%%%% %%.%ds", IM_TEXT_LEN-6);
sprintf(str, numstr, (int)(percent * 100), graph->pairs[i]->name);

gdImageString(im, gdFontSmall, x1_tb+1, y1_tb+1, str, col_border_sh);

Note: the patch makes graph->pairs[i]->name one char shorter because. I have no idea if this is serious - my guess is that it shortens a label in the diagram which doesn't really hurt..

Discussion


Log in to post a comment.

MongoDB Logo MongoDB