Ensure strncpy'd strings are null terminated

(bzr r14332)

4 files changed, 9 insertions, 3 deletions

diff --git a/src/extension/internal/metafile-print.cpp b/src/extension/internal/metafile-print.cpp
index 2fb36be85..47ba5971c 100644
--- a/src/extension/internal/metafile-print.cpp
+++ b/src/extension/internal/metafile-print.cpp
@@ -285,8 +285,8 @@ void PrintMetafile::brush_classify(SPObject *parent, int depth, Inkscape::Pixbuf
                 return;
             }
             char temp[32];  // large enough
-            temp[31] = '\0';
-            strncpy(temp, pat_i->getAttribute("id"), 31); // Some names may be longer than [EW]MFhatch#_######
+            strncpy(temp, pat_i->getAttribute("id"), sizeof(temp)-1); // Some names may be longer than [EW]MFhatch#_######
+            temp[sizeof(temp)-1] = '\0';
             hatch_classify(temp, hatchType, hatchColor, bkColor);
             if (*hatchType != -1) {
                 return;
diff --git a/src/extension/internal/pdfinput/svg-builder.cpp b/src/extension/internal/pdfinput/svg-builder.cpp
index 58e2030d9..a448be639 100644
--- a/src/extension/internal/pdfinput/svg-builder.cpp
+++ b/src/extension/internal/pdfinput/svg-builder.cpp
@@ -498,6 +498,7 @@ void SvgBuilder::addShadedFill(GfxShading *shading, double *matrix, GfxPath *pat
             // Obtain clipping path's id from the URL
             gchar clip_path_id[32];
             strncpy(clip_path_id, clip_path_url + 5, strlen(clip_path_url) - 6);
+	    clip_path_id[sizeof (clip_path_id) - 1] = '\0';
             SPObject *clip_obj = _doc->getObjectById(clip_path_id);
             if (clip_obj) {
                 clip_obj->deleteObject();
diff --git a/src/io/streamtest.cpp b/src/io/streamtest.cpp
index 2030e6a85..ec59ac4a6 100644
--- a/src/io/streamtest.cpp
+++ b/src/io/streamtest.cpp
@@ -202,6 +202,7 @@ void path_init(char *path, char *name)
 	    exit(1);
     }
     strncpy(ptr+1,name,strlen(name)+1);
+    path[PATH_MAX-1] = '\0';
     printf("'%s'\n",path);
 }
 
diff --git a/src/libuemf/uemf.c b/src/libuemf/uemf.c
index 3180c757c..afa116e75 100644
--- a/src/libuemf/uemf.c
+++ b/src/libuemf/uemf.c
@@ -1858,8 +1858,8 @@ U_LOGCOLORSPACEA logcolorspacea_set(
    lcsa.lcsIntent     =    lcsIntent;   
    lcsa.lcsEndpoints  =    lcsEndpoints;
    lcsa.lcsGammaRGB   =    lcsGammaRGB; 
-   memset(lcsa.lcsFilename,0,U_MAX_PATH);  // zero out the Filename field
    strncpy(lcsa.lcsFilename,lcsFilename,U_MAX_PATH);
+   lcsa.lcsFilename[U_MAX_PATH-1] = '\0';
    return(lcsa);
 }
 
@@ -1889,6 +1889,7 @@ U_LOGCOLORSPACEW logcolorspacew_set(
     lcsa.lcsEndpoints  =    lcsEndpoints;
     lcsa.lcsGammaRGB   =    lcsGammaRGB; 
     wchar16strncpypad(lcsa.lcsFilename,lcsFilename,U_MAX_PATH);
+    lcsa.lcsFilename[U_MAX_PATH-1] = '\0';
     return(lcsa);
 }
 
@@ -1983,6 +1984,7 @@ U_LOGFONT logfont_set(
     lf.lfQuality                 = lfQuality;         
     lf.lfPitchAndFamily          = lfPitchAndFamily;  
     wchar16strncpypad(lf.lfFaceName, lfFaceName, U_LF_FACESIZE); // pad this one as the intial structure was not set to zero
+    lf.lfFaceName[U_LF_FACESIZE-1] = '\0';
     return(lf);
 }
 
@@ -2006,7 +2008,9 @@ U_LOGFONT_PANOSE logfont_panose_set(
    U_LOGFONT_PANOSE lfp;
    memset(&lfp,0,sizeof(U_LOGFONT_PANOSE)); // all fields zero unless needed.  Many should be ignored or must be 0.
    wchar16strncpy(lfp.elfFullName, elfFullName, U_LF_FULLFACESIZE);
+   lfp.elfFullName[U_LF_FULLFACESIZE-1] = '\0';
    wchar16strncpy(lfp.elfStyle,    elfStyle,    U_LF_FACESIZE);
+   lfp.elfStyle[U_LF_FACESIZE-1] = '\0';
    lfp.elfLogFont    =   elfLogFont;
    lfp.elfStyleSize  =   elfStyleSize;
    lfp.elfPanose     =   elfPanose;