Bug #720751 - camel_tag_set() doesn't copy tag's name properly

diff --git a/camel/camel-folder-summary.c b/camel/camel-folder-summary.c
index 20ef192..7fc0899 100644 (file)
--- a/camel/camel-folder-summary.c
+++ b/camel/camel-folder-summary.c
@@ -4080,7 +4080,7 @@ camel_flag_set (CamelFlag **list,
        if (value) {
                tmp_len = sizeof (*tmp) + strlen (name);
                tmp = g_malloc (tmp_len);
-               g_strlcpy (tmp->name, name, tmp_len);
+               g_strlcpy (tmp->name, name, strlen (name) + 1);
                tmp->next = NULL;
                flag->next = tmp;
        }
@@ -4235,7 +4235,7 @@ camel_tag_set (CamelTag **list,
 
        if (value) {
                tmp = g_malloc (sizeof (*tmp) + strlen (name));
-               g_strlcpy (tmp->name, name, sizeof (tmp->name));
+               g_strlcpy (tmp->name, name, strlen (name) + 1);
                tmp->value = g_strdup (value);
                tmp->next = NULL;
                tag->next = tmp;

diff --git a/camel/camel-lock-helper.c b/camel/camel-lock-helper.c
index 86f0811..19a0331 100644 (file)
--- a/camel/camel-lock-helper.c
+++ b/camel/camel-lock-helper.c
@@ -178,7 +178,7 @@ lock_path (const gchar *path,
                info->uid = lock_real_uid;
        }
 
-       g_strlcpy (info->path, path, sizeof (info->path));
+       g_strlcpy (info->path, path, strlen (path) + 1);
        info->id = lock_id;
        info->depth = 1;
        info->next = lock_info_list;