summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJun Fang <jun_fang@foxitsoftware.com>2015-04-07 16:59:05 -0700
committerJUN FANG <jun_fang@foxitsoftware.com>2015-04-07 18:13:56 -0700
commitc851dbd549edcd211dc1e9e5f70c740abaa4933f (patch)
tree93357f3b399498e1869cf67bdc6f864b57844213
parent870292c729dc277c24490ee1febd5391643da000 (diff)
downloadpdfium-c851dbd549edcd211dc1e9e5f70c740abaa4933f.tar.xz
Merge to XFA: Fix a stack overflow issue caused by an invalid usage of snprintf
BUG=469244 R=tsepez@chromium.org Review URL: https://codereview.chromium.org/1062983002
-rw-r--r--core/src/fxcrt/fx_basic_wstring.cpp4
1 files changed, 2 insertions, 2 deletions
diff --git a/core/src/fxcrt/fx_basic_wstring.cpp b/core/src/fxcrt/fx_basic_wstring.cpp
index dfdbef8bd6..ce6a1cd763 100644
--- a/core/src/fxcrt/fx_basic_wstring.cpp
+++ b/core/src/fxcrt/fx_basic_wstring.cpp
@@ -976,9 +976,9 @@ void CFX_WideString::FormatV(FX_LPCWSTR lpszFormat, va_list argList)
nItemLen = nPrecision + nWidth + 128;
} else {
double f;
- char pszTemp[256];
+ char pszTemp[256] = {0};
f = va_arg(argList, double);
- FXSYS_snprintf(pszTemp, sizeof(pszTemp), "%*.*f", nWidth, nPrecision + 6, f );
+ FXSYS_snprintf(pszTemp, sizeof(pszTemp) - 1, "%*.*f", nWidth, nPrecision + 6, f );
nItemLen = (FX_STRSIZE)FXSYS_strlen(pszTemp);
}
break;