Potential memory overrun bug due to fixed length string in ImportGUI()

[Peter Clifton]

commit 1574518c1e76b195bf498b7136de58d416a55654

hid/gtk: ImportGUI() can select multiple files

..with one small modification to the original patch by Felix Ruoff

Closes-bug: lp-934616

This patch should not have used:

 + gchar sname[128];

and then written into this string without at least some length checking.

Ideally there would be no artificially imposed limit upon this string length.

[DJ Delorie (djdelorie)]

The only thing written to this buffer (at the moment) is a fixed string with an integer appended. Until we get to 384-bit integers, we won't overrun that buffer. Confirm?

[Traumflug (mah-jump-ing)]

I agree with both of you. It's unlikely the string will ever overflow, still it's a good general practice to use the length-checking version of sprintf(), snprintf().

Made a commit and put it directly onto master:
http://git.geda-project.org/pcb/commit/

[Traumflug (mah-jump-ing)]

Hmm. That's
http://git.geda-project.org/pcb/commit/?id=c6331eec9767d4d3d761ca9aac5b3c0544c1164d