Ticket #8975: scummvm-0.13-bufferoverflow.patch

engines/saga/sfuncs.cpp

@@ -1570 +1570 @@
 
         for (int i = 0; i < nArgs; i++) {
                 snprintf(buf1, 100, "%d", thread->pop());
-                strncat(buf, buf1, 256);
+                strncat(buf, buf1, sizeof(buf) - strlen(buf) - 1);
                 if (i + 1 < nArgs)
-                        strncat(buf, ", ", 256);
+                        strncat(buf, ", ", sizeof(buf) - strlen(buf) - 1);
         }
 
         debug(0, "%s)", buf);

engines/scumm/he/logic_he.cpp

@@ -86 +86 @@
 
         for (int i = 1; i < numArgs; i++) {
                 snprintf(tmp, 32, ", %d", args[i]);
-                strncat(str, tmp, 256);
+                strncat(str, tmp, sizeof(str) - strlen(str) - 1);
         }
-        strncat(str, "])", 256);
+        strncat(str, "])", sizeof(str) - strlen(str) - 1);
 
         debug(0, "%s", str);
 #else