Fix possible buffer overflows in the viewer application.

2 files changed, 7 insertions, 8 deletions

diff --git a/apps/common/pdfapp.c b/apps/common/pdfapp.c
index 367a195c..14a710b5 100644
--- a/apps/common/pdfapp.c
+++ b/apps/common/pdfapp.c
@@ -288,13 +288,14 @@ static void pdfapp_showpage(pdfapp_t *app, int loadpage, int drawpage)
 	wincursor(app, ARROW);
 }
 
-
 static void pdfapp_gotouri(pdfapp_t *app, fz_obj *uri)
 {
-	char buf[2048];
+	char *buf;
+	buf = fz_malloc(fz_tostrlen(uri) + 1);
 	memcpy(buf, fz_tostrbuf(uri), fz_tostrlen(uri));
 	buf[fz_tostrlen(uri)] = 0;
 	winopenuri(app, buf);
+	fz_free(buf);
 }
 
 static void pdfapp_gotopage(pdfapp_t *app, fz_obj *obj)
diff --git a/apps/unix/x11pdf.c b/apps/unix/x11pdf.c
index 68c93ac1..20b9d79e 100644
--- a/apps/unix/x11pdf.c
+++ b/apps/unix/x11pdf.c
@@ -428,12 +428,10 @@ void onselreq(Window requestor, Atom selection, Atom target, Atom property, Time
 
 void winopenuri(pdfapp_t *app, char *buf)
 {
-	char cmd[2048];
-	if (getenv("BROWSER"))
-		sprintf(cmd, "$BROWSER %s &", buf);
-	else
-		sprintf(cmd, "open %s", buf);
-	system(cmd);
+	char *browser = getenv("BROWSER");
+	if (!browser)
+		browser = "open";
+	execlp(browser, browser, buf, 0);
 }
 
 static void onkey(int c)