If buffer copying is restricted by the buffer size in strncpy or
snprintf, the copied string is not NULL terminated.  Add one to the end
just to make sure.

Signed-off-by: Miika Turkia <[email protected]>
---
 statistics.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/statistics.c b/statistics.c
index 6a6d177..fbb7397 100644
--- a/statistics.c
+++ b/statistics.c
@@ -365,5 +365,7 @@ char *get_gaslist(struct dive *dive)
        }
        if (*buf == '\0')
                strncpy(buf, translate("gettextFromC","air"), MAXBUF);
+
+       buf[MAXBUF - 1] = '\0';
        return buf;
 }
-- 
1.8.3.2

_______________________________________________
subsurface mailing list
[email protected]
http://lists.hohndel.org/cgi-bin/mailman/listinfo/subsurface

Reply via email to