From 4687a1c9ffe0d1d3f6ea01f360faa542a5b6491c Mon Sep 17 00:00:00 2001
From: Kees Cook <kees@outflux.net>
Date: Tue, 20 Mar 2007 17:16:36 +0000
Subject: format string protection/clean up (CVE-2007-1463, CVE-2007-1464)

(bzr r2720)
---
 src/extension/internal/pov-out.cpp | 5 +++--
 src/extension/internal/pov-out.h   | 3 +--
 src/extension/internal/svg.cpp     | 2 +-
 3 files changed, 5 insertions(+), 5 deletions(-)

(limited to 'src/extension')

diff --git a/src/extension/internal/pov-out.cpp b/src/extension/internal/pov-out.cpp
index 54d49a79a..7318fa784 100644
--- a/src/extension/internal/pov-out.cpp
+++ b/src/extension/internal/pov-out.cpp
@@ -124,9 +124,10 @@ void PovOutput::out(char *fmt, ...)
 {
     va_list args;
     va_start(args, fmt);
-    g_vsnprintf(fmtbuf, 4096, fmt, args);
+    gchar * output = g_strdup_vprintf(fmt, args);
     va_end(args);
-    outbuf.append(fmtbuf);
+    outbuf.append(output);
+    g_free(output);
 }
 
 
diff --git a/src/extension/internal/pov-out.h b/src/extension/internal/pov-out.h
index 951921313..28f630f77 100644
--- a/src/extension/internal/pov-out.h
+++ b/src/extension/internal/pov-out.h
@@ -72,7 +72,7 @@ private:
 	/**
 	 * Format text to our output buffer
 	 */     	
-	void out(char *fmt, ...);
+	void out(char *fmt, ...) G_GNUC_PRINTF(2,3);
 
     /**
      * Output a 2d vector
@@ -155,7 +155,6 @@ private:
     
     //For formatted output
 	String outbuf;
-    char fmtbuf[2048];
 
     //For statistics
     int nrNodes;
diff --git a/src/extension/internal/svg.cpp b/src/extension/internal/svg.cpp
index 9a097bd6e..5d7b38c33 100644
--- a/src/extension/internal/svg.cpp
+++ b/src/extension/internal/svg.cpp
@@ -120,7 +120,7 @@ _load_uri (const gchar *uri)
     GnomeVFSResult result = gnome_vfs_open (&handle, uri_local, GNOME_VFS_OPEN_READ);
 
     if (result != GNOME_VFS_OK) {
-        g_warning(gnome_vfs_result_to_string(result));
+        g_warning("%s", gnome_vfs_result_to_string(result));
     }
 
     std::vector<gchar> doc;
-- 
cgit v1.2.3