[Poppler-bugs] [Bug 23074] buffer overflow in the Abiword backend

[bugzilla-daemon at freedesktop.org]

http://bugs.freedesktop.org/show_bug.cgi?id=23074


Jakub Wilk <ubanus at users.sf.net> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |ubanus at users.sf.net




--- Comment #3 from Jakub Wilk <ubanus at users.sf.net>  2009-08-23 06:48:34 PST ---
String length is 20, which means that it occupies 21 bytes, but the buffer is
20 bytes only.

To format a double with "%f" you need:
- DBL_MAX_10_EXP + 1 bytes for an integer part;
- 1 byte for the decimal separator;
- 6 bytes for a fractional part;
- 1 byte for the null character.


-- 
Configure bugmail: http://bugs.freedesktop.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.