* xfaces.c (x_update_menu_appearance): Don't overrun buffer

if X resource line is longer than 512 bytes.

diff --git a/src/ChangeLog b/src/ChangeLog
index 97d1ea08db1abec8ba9f0473cffb5bec979d26fd..aeb984ee8df776db774beda361a1a2d187a50985 100644 (file)
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -91,6 +91,9 @@
        * term.c (produce_glyphless_glyph): Make sprintf buffer a bit bigger
        to avoid potential buffer overrun.
 
+       * xfaces.c (x_update_menu_appearance): Don't overrun buffer
+       if X resource line is longer than 512 bytes.
+
 2011-08-26  Paul Eggert  <eggert@cs.ucla.edu>
 
        Integer and memory overflow issues (Bug#9196).

diff --git a/src/xfaces.c b/src/xfaces.c
index 431ca07b8dfe3e428d88181326f79dafba113bac..47d55f4da4b6f4ad0a13acd2ada56203936044d4 100644 (file)
--- a/src/xfaces.c
+++ b/src/xfaces.c
@@ -3549,6 +3549,8 @@ x_update_menu_appearance (struct frame *f)
          rdb != NULL))
     {
       char line[512];
+      char *buf = line;
+      ptrdiff_t bufsize = sizeof line;
       Lisp_Object lface = lface_from_face_name (f, Qmenu, 1);
       struct face *face = FACE_FROM_ID (f, MENU_FACE_ID);
       const char *myname = SSDATA (Vx_resource_name);
@@ -3561,24 +3563,25 @@ x_update_menu_appearance (struct frame *f)
 
       if (STRINGP (LFACE_FOREGROUND (lface)))
        {
-         sprintf (line, "%s.%s*foreground: %s",
-                  myname, popup_path,
-                  SDATA (LFACE_FOREGROUND (lface)));
+         exprintf (&buf, &bufsize, line, -1, "%s.%s*foreground: %s",
+                   myname, popup_path,
+                   SDATA (LFACE_FOREGROUND (lface)));
          XrmPutLineResource (&rdb, line);
-         sprintf (line, "%s.pane.menubar*foreground: %s",
-                  myname, SDATA (LFACE_FOREGROUND (lface)));
+         exprintf (&buf, &bufsize, line, -1, "%s.pane.menubar*foreground: %s",
+                   myname, SDATA (LFACE_FOREGROUND (lface)));
          XrmPutLineResource (&rdb, line);
          changed_p = 1;
        }
 
       if (STRINGP (LFACE_BACKGROUND (lface)))
        {
-         sprintf (line, "%s.%s*background: %s",
-                  myname, popup_path,
-                  SDATA (LFACE_BACKGROUND (lface)));
+         exprintf (&buf, &bufsize, line, -1, "%s.%s*background: %s",
+                   myname, popup_path,
+                   SDATA (LFACE_BACKGROUND (lface)));
          XrmPutLineResource (&rdb, line);
-         sprintf (line, "%s.pane.menubar*background: %s",
-                  myname, SDATA (LFACE_BACKGROUND (lface)));
+
+         exprintf (&buf, &bufsize, line, -1, "%s.pane.menubar*background: %s",
+                   myname, SDATA (LFACE_BACKGROUND (lface)));
          XrmPutLineResource (&rdb, line);
          changed_p = 1;
        }
@@ -3616,11 +3619,12 @@ x_update_menu_appearance (struct frame *f)
 #else
              char *fontsetname = SSDATA (xlfd);
 #endif
-             sprintf (line, "%s.pane.menubar*font%s: %s",
-                      myname, suffix, fontsetname);
+             exprintf (&buf, &bufsize, line, -1, "%s.pane.menubar*font%s: %s",
+                       myname, suffix, fontsetname);
              XrmPutLineResource (&rdb, line);
-             sprintf (line, "%s.%s*font%s: %s",
-                      myname, popup_path, suffix, fontsetname);
+
+             exprintf (&buf, &bufsize, line, -1, "%s.%s*font%s: %s",
+                       myname, popup_path, suffix, fontsetname);
              XrmPutLineResource (&rdb, line);
              changed_p = 1;
              if (fontsetname != SSDATA (xlfd))
@@ -3630,6 +3634,9 @@ x_update_menu_appearance (struct frame *f)
 
       if (changed_p && f->output_data.x->menubar_widget)
        free_frame_menubar (f);
+
+      if (buf != line)
+       xfree (buf);
     }
 }