Fix unsafe use of fixed width arrays.

Fix crash when MathMatrix has more than 80 columns

Patch from John McCabe-Dansted, approved from Andre.


git-svn-id: svn://svn.lyx.org/lyx/lyx-devel/trunk@33641 a592a061-630c-0410-9148-cb99ea01b6c8
This commit is contained in:
Pavel Sanda 2010-03-06 14:57:16 +00:00
parent 61e55ac197
commit a7b921aeeb
4 changed files with 7 additions and 12 deletions

View File

@ -246,14 +246,14 @@ bool isValidGlueLength(string const & data, GlueLength * result)
int pattern_index = 0;
int table_index = 0;
char pattern[20];
char pattern[22]; // 20 + 1 for pattern[20], + 1 for '\0'
number_index = 1;
unit_index = 1; // entries at index 0 are sentinels
// construct "pattern" from "data"
while (!isEndOfData(buffer)) {
if (pattern_index > 20)
if (pattern_index > (sizeof(pattern) - 2))
return false;
pattern[pattern_index] = nextToken(buffer);
if (pattern[pattern_index] == 'E')

View File

@ -108,8 +108,9 @@ static docstring const formatted(docstring const & text)
void noAppDialog(QString const & title, QString const & msg, QMessageBox::Icon mode)
{
int argc = 1;
char * argv[1];
QApplication app(argc, argv);
const char *argv[] = { "lyx", 0 };
QApplication app(argc, (char**)argv);
switch (mode)
{
case QMessageBox::Information: QMessageBox::information(0, title, msg); break;

View File

@ -66,13 +66,8 @@ GuiMathMatrix::GuiMathMatrix(GuiView & lv)
void GuiMathMatrix::columnsChanged(int)
{
char h_align_str[80] = "c";
int const nx = int(columnsSB->value());
for (int i = 0; i < nx; ++i)
h_align_str[i] = 'c';
h_align_str[nx] = '\0';
halignED->setText(h_align_str);
halignED->setText(QString(nx, 'c'));
}

View File

@ -739,8 +739,7 @@ docstring const makeDisplayPath(string const & path, unsigned int threshold)
bool readLink(FileName const & file, FileName & link)
{
#ifdef HAVE_READLINK
char linkbuffer[512];
// Should be PATH_MAX but that needs autconf support
char linkbuffer[PATH_MAX + 1];
string const encoded = file.toFilesystemEncoding();
int const nRead = ::readlink(encoded.c_str(),
linkbuffer, sizeof(linkbuffer) - 1);