bug#4763: Buffer overflow in ns_get_color (nsterm.m:1347)
Mike <[email protected]> Mon, 19 Oct 2009 23:32:06 -0700
| Newsgroups | gmane.emacs.bugs,gmane.emacs.pretest.bugs |
|---|---|
| Message-ID | <[email protected]> |
Package: emacs,ns
1347 else if (!strncmp(name, "rgb:", 4)) /* A newer X11 format
-- rgb:r/g/b */
1348 {
1349 strcpy(hex, name + 4);
1350 scaling = (strlen(hex) - 2) / 3;
1351 }
strcpy will happily overwrite the bounds of hex.