diff options
| author | Stephan Bergmann <sbergman@redhat.com> | 2013-12-04 16:38:46 +0100 |
|---|---|---|
| committer | Stephan Bergmann <sbergman@redhat.com> | 2013-12-04 16:41:36 +0100 |
| commit | 13448d8afd5981aa09ffb95ace22bca9bcac4c3a (patch) | |
| tree | 1d906957b05a47baeb549e39c003c3a2f47b1581 /extensions/source/nsplugin | |
| parent | 1ded21bfb99951ca947bd11a7442398668202ca6 (diff) | |
Fix one more use of wsprintf
...that would fall into the same trap as
50bd5c11f551f5274be9a4411c5ddcbd32bd9a03 "wsprintf is broken by design and never
writes more than 1024 characters" if the length were not currently bounded by
2 * MAX_PATH + x < 1024 anyway.
Change-Id: I2503ba0a9df960f2fdb51925d5fbbcff5bdb998a
Diffstat (limited to 'extensions/source/nsplugin')
| -rw-r--r-- | extensions/source/nsplugin/source/npshell.cxx | 15 |
1 files changed, 7 insertions, 8 deletions
diff --git a/extensions/source/nsplugin/source/npshell.cxx b/extensions/source/nsplugin/source/npshell.cxx index 644222d12df4..42b99ae35474 100644 --- a/extensions/source/nsplugin/source/npshell.cxx +++ b/extensions/source/nsplugin/source/npshell.cxx @@ -274,14 +274,13 @@ int do_init_pipe() if (iniEnd == NULL) { return NPERR_GENERIC_ERROR; } - boost::scoped_array< WCHAR > args( - new WCHAR[ - MY_LENGTH(L"\"") + (exeEnd - exe) + MY_LENGTH(L"\" ") + - wcslen(s_read_fd) + MY_LENGTH(L" ") + wcslen(s_write_fd) + - MY_LENGTH(L" \"-env:INIFILENAME=vnd.sun.star.pathname:") + - (iniEnd - ini) + MY_LENGTH(L"\"") + 1]); //TODO: overflow - wsprintfW( - args.get(), + size_t len = MY_LENGTH(L"\"") + (exeEnd - exe) + MY_LENGTH(L"\" ") + + wcslen(s_read_fd) + MY_LENGTH(L" ") + wcslen(s_write_fd) + + MY_LENGTH(L" \"-env:INIFILENAME=vnd.sun.star.pathname:") + + (iniEnd - ini) + MY_LENGTH(L"\"") + 1; //TODO: overflow + boost::scoped_array< WCHAR > args(new WCHAR[len]); + _snwprintf( + args.get(), len, L"\"%s\" %s %s \"-env:INIFILENAME=vnd.sun.star.pathname:%s\"", exe, s_read_fd, s_write_fd, ini); STARTUPINFOW NSP_StarInfo; |