Fix buffer overflow in ns_get_color.

* nsterm.m (ns_get_color): Fix buffer overflow (Bug#4763).

diff --git a/src/ChangeLog b/src/ChangeLog
index 73000341f68fd8e9be05a51671ef73bd7afb274a..d6e7f2c9791fcfbc83e7be9bef60582c90dc7874 100644 (file)
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,5 +1,7 @@
 2010-01-01  Chong Yidong  <cyd@stupidchicken.com>
 
+       * nsterm.m (ns_get_color): Fix buffer overflow (Bug#4763).
+
        * lread.c (syms_of_lread): Make it clearer that these are the
        names of loaded files (Bug#5068).
 

diff --git a/src/nsterm.m b/src/nsterm.m
index 9256c084e28ed544a70f686431b6fd9623013ed4..2eebbf8664350cfa5aa492e3a4bdad889ec98413 100644 (file)
--- a/src/nsterm.m
+++ b/src/nsterm.m
@@ -1346,7 +1346,8 @@ ns_get_color (const char *name, NSColor **col)
     }
   else if (!strncmp(name, "rgb:", 4))  /* A newer X11 format -- rgb:r/g/b */
     {
-      strcpy(hex, name + 4);
+      strncpy (hex, name + 4, 19);
+      hex[19] = '\0';
       scaling = (strlen(hex) - 2) / 3;
     }
   else if (name[0] == '#')        /* An old X11 format; convert to newer */