From 684c4cc40d75b07c2b23cc8ee6f1798c95942e44 Mon Sep 17 00:00:00 2001 From: Campbell Barton Date: Sat, 27 Jul 2013 18:16:22 +0000 Subject: fix for BKE_deform_split_suffix() - out of bounds read when passing in empty string. - single character prefix didnt work. - with no suffix, the string body was truncated. --- source/blender/blenkernel/intern/deform.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'source/blender/blenkernel/intern/deform.c') diff --git a/source/blender/blenkernel/intern/deform.c b/source/blender/blenkernel/intern/deform.c index 0dd9d8550bb..882085aa5db 100644 --- a/source/blender/blenkernel/intern/deform.c +++ b/source/blender/blenkernel/intern/deform.c @@ -537,7 +537,7 @@ void BKE_deform_split_suffix(const char string[MAX_VGROUP_NAME], char body[MAX_V body[0] = suf[0] = '\0'; - for (i = len - 1; i > 1; i--) { + for (i = len; i > 0; i--) { if (is_char_sep(string[i])) { BLI_strncpy(body, string, i + 1); BLI_strncpy(suf, string + i, (len + 1) - i); @@ -545,7 +545,7 @@ void BKE_deform_split_suffix(const char string[MAX_VGROUP_NAME], char body[MAX_V } } - BLI_strncpy(body, string, len); + memcpy(body, string, len + 1); } /* "a.b.c" -> ("a.", "b.c") */ -- cgit v1.2.3