tree 9026587fa114d1a4056e0df4a50e807e943b2969
parent 9f09fa4a563d9b2bba75d502b57bd1276d2f1f85
author Ryan C. Gordon <icculus@icculus.org> 1475605531 -0400
committer Ryan C. Gordon <icculus@icculus.org> 1475605531 -0400

Fixed potential buffer overflow in SDL_vsnprintf() (thanks, Taylor!).

Fixes Bugzilla #3441.

"When using internal SDL_vsnprintf(), and source string length is greater
than destination, the final NULL char will be written beyond destination size.

Primary issue that is SDL_strlcpy returns length of source string
(SDL_PrintString()), not how much is written to destination. The destination
ptr is then incremented by this length before the sanity check is done.
Destination string is properly terminated, but an extra NULL char will be
written beyond destination buffer length.

Patch used internally is attached which fixes primary issue with SDL_strlcpy()
in SDL_PrintString() and adjusts sanity checks to increment destination ptr
safely."