strcpy_s does not truncate, use strncpy_s instead, and ensure the nul…

…l-terminator is always included.
poizan42 · Jun 12, 2017 · 39d2b29 · 39d2b29
1 parent c1d0ae9
commit 39d2b29
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/src/lib/network_c_bindings.cc b/src/lib/network_c_bindings.cc
@@ -26,9 +26,9 @@ CAPI(void) wkhtmltox_network_request_get_url(const wkhtmltox_network_request* re
 	QByteArray s(reinterpret_cast<const QNetworkRequest*>(req)->url().toEncoded());
 	int bufLen(*cb);
 
-	*cb = s.length();
+	*cb = s.length() + 1; // Include the null-terminator
 	if (url)
-		strcpy_s(url, bufLen, s.constData());
+		strncpy_s(url, bufLen, s.constData(), bufLen - 1 /* ensure the null-terminator is included. */);
 }
 CAPI(void) wkhtmltox_network_request_set_url(wkhtmltox_network_request* req, const char* url) {
 	reinterpret_cast<QNetworkRequest*>(req)->setUrl(QUrl(QString::fromUtf8(url)));