Merge pull request #5567 from radarhere/sprintf

Limit sprintf modes to 10 characters
python-pillow · Jul 1, 2021 · 31c4738 · 31c4738
2 parents 23b2151 + 518ee37
commit 31c4738
Showing 1 changed file with 6 additions and 7 deletions.
diff --git a/src/libImaging/Convert.c b/src/libImaging/Convert.c
@@ -1594,9 +1594,8 @@ convert(
 #ifdef notdef
         return (Imaging)ImagingError_ValueError("conversion not supported");
 #else
-        static char buf[256];
-        /* FIXME: may overflow if mode is too large */
-        sprintf(buf, "conversion from %s to %s not supported", imIn->mode, mode);
+        static char buf[100];
+        snprintf(buf, 100, "conversion from %.10s to %.10s not supported", imIn->mode, mode);
         return (Imaging)ImagingError_ValueError(buf);
 #endif
     }
@@ -1645,11 +1644,11 @@ ImagingConvertTransparent(Imaging imIn, const char *mode, int r, int g, int b) {
     }
 #else
     {
-        static char buf[256];
-        /* FIXME: may overflow if mode is too large */
-        sprintf(
+        static char buf[100];
+        snprintf(
             buf,
-            "conversion from %s to %s not supported in convert_transparent",
+            100,
+            "conversion from %.10s to %.10s not supported in convert_transparent",
             imIn->mode,
             mode);
         return (Imaging)ImagingError_ValueError(buf);