From e60197962af7168f9b8b0517ffbf8e4917cfae48 Mon Sep 17 00:00:00 2001
From: Thomas Goyne <plorkyeran@aegisub.org>
Date: Tue, 8 Jul 2014 09:21:13 -0700
Subject: [PATCH] Fix buffer overflow when getting text extents
lfFaceName needs to be null-terminated, so only copy up to 31 characters
into the buffer.
---
src/auto4_base.cpp | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/auto4_base.cpp b/src/auto4_base.cpp
index 8bb753d62..d51a3e98f 100644
--- a/src/auto4_base.cpp
+++ b/src/auto4_base.cpp
@@ -86,7 +86,7 @@ namespace Automation4 {
lf.lfClipPrecision = CLIP_DEFAULT_PRECIS;
lf.lfQuality = ANTIALIASED_QUALITY;
lf.lfPitchAndFamily = DEFAULT_PITCH|FF_DONTCARE;
- wcsncpy(lf.lfFaceName, agi::charset::ConvertW(style->font).c_str(), 32);
+ wcsncpy(lf.lfFaceName, agi::charset::ConvertW(style->font).c_str(), 31);
HFONT thefont = CreateFontIndirect(&lf);
if (!thefont) return false;
--
GitLab