strlcpy() takes buffer size, not char count, and will copy buffer size - 1 chars
at max and terminate the buffer. git-svn-id: http://svn.haiku-os.org/webpositive/webkit/trunk@406 94f232f2-1747-11df-bad5-a5bfde151594
This commit is contained in:
committed by
Alexandre Deckner
parent
560610f70e
commit
f9977c07c1
@@ -323,7 +323,7 @@ URLInputGroup::URLTextView::InsertText(const char* inText, int32 inLength,
|
|||||||
buffer = (char*)malloc(inLength + 1);
|
buffer = (char*)malloc(inLength + 1);
|
||||||
|
|
||||||
if (buffer) {
|
if (buffer) {
|
||||||
strlcpy(buffer, inText, inLength);
|
strlcpy(buffer, inText, inLength + 1);
|
||||||
|
|
||||||
for (int32 i = 0; i < inLength; i++) {
|
for (int32 i = 0; i < inLength; i++) {
|
||||||
if (buffer[i] == '\r' || buffer[i] == '\n')
|
if (buffer[i] == '\r' || buffer[i] == '\n')
|
||||||
|
|||||||
Reference in New Issue
Block a user