Making sure that a copied string is always null-terminated (#66345).

A more minimalistic and formally correct solution.
This amends and extends the previous fix for bug #66345,
fixing not just yyGetKeyName() but also yyGetString().

Signed-off-by: Benno Schulenberg <bensberg@justemail.net>

Fixes a typo from cdcd552 (should be sizeof - 1, not sizeof -i).
Code flows that i is at most sizeof(scanBuf) - 1, so last is not needed.

Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>

1 files changed, 2 insertions, 12 deletions

diff --git a/xkbscan.c b/xkbscan.c
index 144f315..237f520 100644
--- a/xkbscan.c
+++ b/xkbscan.c
@@ -388,9 +388,9 @@ yyGetString(void)
         if (i < sizeof(scanBuf) - 1)
             scanBuf[i++] = ch;
     }
+    scanBuf[i] = '\0';
     if (ch == '"')
     {
-        scanBuf[i++] = '\0';
         scanStrLine = lineNum;
         return STRING;
     }
@@ -401,7 +401,6 @@ static int
 yyGetKeyName(void)
 {
     int ch, i;
-    int last;
 
     i = 0;
     while (((ch = scanchar()) != EOF) && (ch != '>'))
@@ -463,24 +462,15 @@ yyGetKeyName(void)
             else
                 return ERROR_TOK;
         }
-
         if (i < sizeof(scanBuf) - 1)
             scanBuf[i++] = ch;
     }
-
-    if (i < sizeof(scanBuf) - i)
-        last = i;
-    else
-        last = sizeof(scanBuf) - 1;
-
-    scanBuf[last] = '\0';
-
+    scanBuf[i] = '\0';
     if ((ch == '>') && (i < 5))
     {
         scanStrLine = lineNum;
         return KEYNAME;
     }
-
     return ERROR_TOK;
 }