Fixed read of body in fmttest to limit size to that of rbuf, if

smaller than outwidth, to avoid overrunning it.

diff --git a/uip/fmttest.c b/uip/fmttest.c
index ad9dcef0373d66d626778cf3486fdbdc2e1508d1..1a3f633e554bd712e7cd7f6f56a6b085c3fb5df9 100644 (file)
--- a/uip/fmttest.c
+++ b/uip/fmttest.c
@@ -649,7 +649,7 @@ process_single_file(FILE *in, struct msgs_array *comps, int *dat, int msgsize,
        case BODY:
            if (fmt_findcomp("body")) {
                if ((i = strlen(rbuf)) < outwidth) {
        case BODY:
            if (fmt_findcomp("body")) {
                if ((i = strlen(rbuf)) < outwidth) {

-                   bufsz = outwidth - 1;
+                   bufsz = min (outwidth, (int) sizeof rbuf - i);

                    state = m_getfld(&gstate, name, rbuf + i,
                                     &bufsz, in);
                }
                    state = m_getfld(&gstate, name, rbuf + i,
                                     &bufsz, in);
                }