X-Git-Url: https://ncurses.scripts.mit.edu/?a=blobdiff_plain;f=ncurses%2Ftinfo%2Fwrite_entry.c;h=b53bb210230d7070b821f85b4c838c4283a09bca;hb=8f527f87c0b979d9c2598ef5c3394463af288468;hp=12172deefd86a706b612e915c4a5e31f0471ad8e;hpb=4c309ad3b124eff80aa6b54018b5cc9f1e3d116d;p=ncurses.git

diff --git a/ncurses/tinfo/write_entry.c b/ncurses/tinfo/write_entry.c
index 12172dee..b53bb210 100644
--- a/ncurses/tinfo/write_entry.c
+++ b/ncurses/tinfo/write_entry.c
@@ -54,7 +54,7 @@
 #define TRACE_OUT(p)		/*nothing */
 #endif
 
-MODULE_ID("$Id: write_entry.c,v 1.71 2008/07/05 20:06:25 tom Exp $")
+MODULE_ID("$Id: write_entry.c,v 1.72 2008/08/03 19:24:00 tom Exp $")
 
 static int total_written;
 
@@ -275,6 +275,9 @@ _nc_write_entry(TERMTYPE *const tp)
     char *first_name, *other_names;
     char *ptr;
 
+    assert(strlen(tp->term_names) != 0);
+    assert(strlen(tp->term_names) < sizeof(name_list));
+
     (void) strcpy(name_list, tp->term_names);
     DEBUG(7, ("Name list = '%s'", name_list));
 
@@ -354,7 +357,7 @@ _nc_write_entry(TERMTYPE *const tp)
 	start_time = 0;
     }
 
-    if (strlen(first_name) > sizeof(filename) - 3)
+    if (strlen(first_name) >= sizeof(filename) - 3)
 	_nc_warning("terminal name too long.");
 
     sprintf(filename, LEAF_FMT "/%s", first_name[0], first_name);
@@ -382,6 +385,7 @@ _nc_write_entry(TERMTYPE *const tp)
     }
     while (*other_names != '\0') {
 	ptr = other_names++;
+	assert(ptr < buffer + sizeof(buffer) - 1);
 	while (*other_names != '|' && *other_names != '\0')
 	    other_names++;
 
@@ -691,9 +695,17 @@ write_object(TERMTYPE *tp, char *buffer, unsigned *offset, unsigned limit)
 	if (even_boundary(nextfree))
 	    return (ERR);
 
-	nextfree = compute_offsets(tp->Strings + STRCOUNT, tp->ext_Strings, offsets);
+	nextfree = compute_offsets(tp->Strings + STRCOUNT,
+				   tp->ext_Strings,
+				   offsets);
 	TRACE_OUT(("after extended string capabilities, nextfree=%d", nextfree));
-	nextfree += compute_offsets(tp->ext_Names, extcnt, offsets + tp->ext_Strings);
+
+	if (tp->ext_Strings >= SIZEOF(offsets))
+	    return (ERR);
+
+	nextfree += compute_offsets(tp->ext_Names,
+				    extcnt,
+				    offsets + tp->ext_Strings);
 	TRACE_OUT(("after extended capnames, nextfree=%d", nextfree));
 	strmax = tp->ext_Strings + extcnt;