mirror of
https://github.com/tmux/tmux.git
synced 2025-09-02 13:37:12 +00:00
Don't blindly increase offsets by the return value of snprintf, if there
wasn't enough space this will go off the end. Instead clamp to the available space. Fixes crash reported by Julien Rebetez.
This commit is contained in:
10
cmd-list.c
10
cmd-list.c
@ -103,7 +103,7 @@ size_t
|
||||
cmd_list_print(struct cmd_list *cmdlist, char *buf, size_t len)
|
||||
{
|
||||
struct cmd *cmd;
|
||||
size_t off;
|
||||
size_t off, used;
|
||||
|
||||
off = 0;
|
||||
TAILQ_FOREACH(cmd, &cmdlist->list, qentry) {
|
||||
@ -112,8 +112,12 @@ cmd_list_print(struct cmd_list *cmdlist, char *buf, size_t len)
|
||||
off += cmd_print(cmd, buf + off, len - off);
|
||||
if (off >= len)
|
||||
break;
|
||||
if (TAILQ_NEXT(cmd, qentry) != NULL)
|
||||
off += xsnprintf(buf + off, len - off, " ; ");
|
||||
if (TAILQ_NEXT(cmd, qentry) != NULL) {
|
||||
used = xsnprintf(buf + off, len - off, " ; ");
|
||||
if (used > len - off)
|
||||
used = len - off;
|
||||
off += used;
|
||||
}
|
||||
}
|
||||
return (off);
|
||||
}
|
||||
|
Reference in New Issue
Block a user