From 9686d3005cab50fbb3376ff1fd4c5e55b6a61b23 Mon Sep 17 00:00:00 2001 From: Campbell Barton Date: Sun, 28 Dec 2014 15:59:12 +1100 Subject: Fix buffer overrun calculating unique names --- source/blender/blenlib/intern/path_util.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) (limited to 'source') diff --git a/source/blender/blenlib/intern/path_util.c b/source/blender/blenlib/intern/path_util.c index 0a30a35ba7c..8b570189e29 100644 --- a/source/blender/blenlib/intern/path_util.c +++ b/source/blender/blenlib/intern/path_util.c @@ -228,7 +228,8 @@ bool BLI_uniquename_cb(bool (*unique_check)(void *arg, const char *name), int number; int len = BLI_split_name_num(left, &number, name, delim); do { - const int numlen = BLI_snprintf(numstr, sizeof(numstr), "%c%03d", delim, ++number); + /* add 1 to account for \0 */ + const int numlen = BLI_snprintf(numstr, sizeof(numstr), "%c%03d", delim, ++number) + 1; /* highly unlikely the string only has enough room for the number * but support anyway */ @@ -238,9 +239,8 @@ bool BLI_uniquename_cb(bool (*unique_check)(void *arg, const char *name), } else { char *tempname_buf; - tempname[0] = '\0'; - tempname_buf = BLI_strncat_utf8(tempname, left, name_len - numlen); - memcpy(tempname_buf, numstr, numlen + 1); + tempname_buf = tempname + BLI_strncpy_utf8_rlen(tempname, left, name_len - numlen); + memcpy(tempname_buf, numstr, numlen); } } while (unique_check(arg, tempname)); -- cgit v1.2.3