Commit 728334b0 authored by Birte Kristina Friesel's avatar Birte Kristina Friesel
Browse files

feh_draw_exif: Fix out of bounds array access when handling long lines

parent c188578f

src/imlib.c

+3 −4
Original line number Diff line number Diff line
@@ -1178,7 +1178,7 @@ void feh_draw_exif(winwidget w) 
		{

			/* max 128 lines */

			pos2 = 0;

			while ( pos2 < 256 ) /* max 256 chars per line */

			while ( pos2 < 255 ) /* max 255 chars + 1 null byte per line */

			{

				if ( (buffer[pos] != '\n')

				      && (buffer[pos] != '\0') )
@@ -1188,19 +1188,18 @@ void feh_draw_exif(winwidget w) 
				else if ( buffer[pos] == '\0' )

				{

					pos = EXIF_MAX_DATA; /* all data seen */

					info_line[pos2] = '\0';

					break;

				}

				else

				{

					info_line[pos2] = '\0'; /* line finished, continue with next line*/

					pos++;

					pos++; /* line finished, continue with next line*/

					break;

				}



				pos++;

				pos2++;

			}

			info_line[pos2] = '\0';



			gib_imlib_get_text_size(fn, info_line, NULL, &line_width,

                              &line_height, IMLIB_TEXT_TO_RIGHT);