Fix potential buffer overflow when writing a double (Issue #233)

This commit is contained in:
Michael R Sweet 2018-12-03 11:21:39 -05:00
parent 1afcfdbeb6
commit 4f5577dd46
No known key found for this signature in database
GPG Key ID: 999559A027815955
2 changed files with 4 additions and 2 deletions

View File

@ -1,5 +1,7 @@
# Changes in Mini-XML CURRENT
- Fixed a potential buffer overflow when writing floating point data
(Issue #233)
- Fixed a potential crash bug in mxmldoc found by fuzzing (Issue #235,
Issue #236)
- The `mxmldoc` program now sets the EPUB subject ("Programming").

View File

@ -2881,7 +2881,7 @@ mxml_write_node(mxml_node_t *node, /* I - Node to write */
col ++;
}
sprintf(s, "%d", current->value.integer);
snprintf(s, sizeof(s), "%d", current->value.integer);
if (mxml_write_string(s, p, putc_cb) < 0)
return (-1);
@ -2911,7 +2911,7 @@ mxml_write_node(mxml_node_t *node, /* I - Node to write */
col ++;
}
sprintf(s, "%f", current->value.real);
snprintf(s, sizeof(s), "%f", current->value.real);
if (mxml_write_string(s, p, putc_cb) < 0)
return (-1);