* term.c (produce_glyphless_glyph): Make sprintf buffer a bit bigger

to avoid potential buffer overrun.

diff --git a/src/ChangeLog b/src/ChangeLog
index b1c29363da01f33ea08fb984456f2a665d290aa9..97d1ea08db1abec8ba9f0473cffb5bec979d26fd 100644 (file)
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -88,6 +88,9 @@
        * process.c (make_process): Use printmax_t, not int, to format
        process-name gensyms.
 
+       * term.c (produce_glyphless_glyph): Make sprintf buffer a bit bigger
+       to avoid potential buffer overrun.
+
 2011-08-26  Paul Eggert  <eggert@cs.ucla.edu>
 
        Integer and memory overflow issues (Bug#9196).

diff --git a/src/term.c b/src/term.c
index f3bf3a947cb328e3b568cd5bb916ea880f2910c1..48d4069e20e1f1f58a8fc074fdccd6763a999506 100644 (file)
--- a/src/term.c
+++ b/src/term.c
@@ -1887,7 +1887,7 @@ produce_glyphless_glyph (struct it *it, int for_no_font, Lisp_Object acronym)
 {
   int face_id;
   int len;
-  char buf[9];
+  char buf[sizeof "\\x" + max (6, (sizeof it->c * CHAR_BIT + 3) / 4)];
   char const *str = "    ";
 
   /* Get a face ID for the glyph by utilizing a cache (the same way as