From: Johannes Obermayr <johannesobermayr@gmx.de>
Date: Thu, 28 Jun 2012 08:16:47 +0000 (+0200)
Subject: gallivm: Fix potential buffer overflowing in strncat.
X-Git-Url: https://git.libre-soc.org/?a=commitdiff_plain;h=bf679ce1dcc9cb90bb0092a550a03ad391f6ba72;p=mesa.git

gallivm: Fix potential buffer overflowing in strncat.

Signed-off-by: José Fonseca <jfonseca@vmware.com>
---

diff --git a/src/gallium/auxiliary/gallivm/lp_bld_printf.c b/src/gallium/auxiliary/gallivm/lp_bld_printf.c
index 16ef25a8a39..8549b87a1c7 100644
--- a/src/gallium/auxiliary/gallivm/lp_bld_printf.c
+++ b/src/gallium/auxiliary/gallivm/lp_bld_printf.c
@@ -118,16 +118,16 @@ lp_build_print_value(struct gallivm_state *gallivm,
 
    params[1] = lp_build_const_string(gallivm, msg);
    if (length == 1) {
-      util_strncat(format, type_fmt, sizeof format);
+      util_strncat(format, type_fmt, sizeof(format) - strlen(format) - 1);
       params[2] = value;
    } else {
       for (i = 0; i < length; ++i) {
-         util_strncat(format, type_fmt, sizeof format);
+         util_strncat(format, type_fmt, sizeof(format) - strlen(format) - 1);
          params[2 + i] = LLVMBuildExtractElement(builder, value, lp_build_const_int32(gallivm, i), "");
       }
    }
 
-   util_strncat(format, "\n", sizeof format);
+   util_strncat(format, "\n", sizeof(format) - strlen(format) - 1);
 
    params[0] = lp_build_const_string(gallivm, format);
    return lp_build_print_args(gallivm, 2 + length, params);