bug#4763: Buffer overflow in ns_get_color (nsterm.m:1347)

Mike <[email protected]> Mon, 19 Oct 2009 23:32:06 -0700
Newsgroups gmane.emacs.bugs,gmane.emacs.pretest.bugs
Message-ID <[email protected]>
Package: emacs,ns

   1347   else if (!strncmp(name, "rgb:", 4))  /* A newer X11 format
-- rgb:r/g/b */
   1348     {
   1349       strcpy(hex, name + 4);
   1350       scaling = (strlen(hex) - 2) / 3;
   1351     }

strcpy will happily overwrite the bounds of hex.