yagl_gles3_program: Prevent buffer overflow

Fixes defects WGID 467867 and WGID 467868

Change-Id: I03fca7c5af1d52b6f644c4517e09ee2e931d51c7

diff --git a/GLESv2/yagl_gles3_program.c b/GLESv2/yagl_gles3_program.c
index a304bda7f69c2b8d00812b3f28b51cba6ae67f18..b7e28d933219fb65e3699345a8ed6895a46ee374 100644 (file)
--- a/GLESv2/yagl_gles3_program.c
+++ b/GLESv2/yagl_gles3_program.c
@@ -316,8 +316,8 @@ void yagl_gles3_program_get_uniform_indices(struct yagl_gles2_program *program,
         yagl_free(var->name);
         var->name = yagl_malloc(var->name_size);
 
-        strncpy(var->name, names[fetch_positions[i]], var->name_size);
-        var->name[var->name_size] = 0;
+        strncpy(var->name, names[fetch_positions[i]], var->name_size - 1);
+        var->name[var->name_size - 1] = 0;
 
         var->name_fetched = 1;
     }
@@ -360,10 +360,10 @@ GLuint yagl_gles3_program_get_uniform_block_index(struct yagl_gles2_program *pro
 
         block->name_size = block_name_size + 1;
         yagl_free(block->name);
-        block->name = yagl_malloc(block_name_size);
+        block->name = yagl_malloc(block->name_size);
 
-        strncpy(block->name, block_name, block_name_size);
-        block->name[block_name_size] = 0;
+        strncpy(block->name, block_name, block->name_size - 1);
+        block->name[block->name_size - 1] = 0;
 
         block->name_fetched = 1;
     }