Tobias Stoeckmann 33328d997e Avoid buffer overrun in parseMenuCommand. ...

In parseMenuCommand, title[300] might get filled with a string of length
300.  The string is copied with strcpy, therefore the size would have to be
301 or -- as I propose -- the fixed value 300 gets replaced with
"sizeof(title) - 1".  This shows also that the size 300 belongs to title
and it will already be replaced during compile-time into 299.

2012-05-07 20:45:13 -03:00

7.1 KiB

Raw Blame History

View Raw