From c9534bab25660bd0f9b692820032bfe9531b9ae3 Mon Sep 17 00:00:00 2001 From: Daniel Willmann Date: Mon, 18 Mar 2013 12:07:23 +0000 Subject: [PATCH] toolbar: Use snprintf for elm,number,item buffer handling Avoid potential buffer overflow Signed-off-by: Daniel Willmann --- legacy/elementary/src/lib/elm_toolbar.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/legacy/elementary/src/lib/elm_toolbar.c b/legacy/elementary/src/lib/elm_toolbar.c index b741706b45..6b581090c0 100644 --- a/legacy/elementary/src/lib/elm_toolbar.c +++ b/legacy/elementary/src/lib/elm_toolbar.c @@ -899,7 +899,7 @@ _inform_item_number(Evas_Object *obj) { ELM_TOOLBAR_DATA_GET(obj, sd); Elm_Toolbar_Item *it; - char buf[sizeof("elm,action,click,") + 3]; + char buf[sizeof("elm,number,item,") + 4]; static int scount = 0; int count = 0; @@ -910,7 +910,8 @@ _inform_item_number(Evas_Object *obj) if (scount != count) { scount = count; - sprintf(buf, "elm,number,item,%d", count); + if (snprintf(buf, sizeof(buf), "elm,number,item,%d", count) >= sizeof(buf)) + ERR("Too many items to fit signal buffer (%d)", count); EINA_INLIST_FOREACH(sd->items, it) {