From f4952f040bf61ea856cdcb9cdf8dbb02ff3a6f1e Mon Sep 17 00:00:00 2001
From: Vinson Lee <vlee@vmware.com>
Date: Wed, 6 Jan 2010 14:55:02 -0800
Subject: [PATCH] progs/xdemos: Prevent possible string overflow.

---
 progs/xdemos/glxheads.c | 28 +++++++++++++++++++++++++++-
 1 file changed, 27 insertions(+), 1 deletion(-)

diff --git a/progs/xdemos/glxheads.c b/progs/xdemos/glxheads.c
index b1a63d3..be77ad6 100644
--- a/progs/xdemos/glxheads.c
+++ b/progs/xdemos/glxheads.c
@@ -145,14 +145,40 @@ AddHead(const char *displayName)
    /* save the info for this head */
    {
       struct head *h = &Heads[NumHeads];
+      const char * tmp;
+
+      if (strlen(displayName) + 1 > sizeof(h->DisplayName)) {
+         Error(displayName, "displayName string length overflow");
+         return NULL;
+      }
       strcpy(h->DisplayName, displayName);
+
       h->Dpy = dpy;
       h->Win = win;
       h->Context = ctx;
       h->Angle = 0.0;
-      strcpy(h->Version, (char *) glGetString(GL_VERSION));
+
+      tmp = (char *) glGetString(GL_VERSION);
+      if (strlen(tmp) + 1 > sizeof(h->Version)) {
+         Error(displayName, "GL_VERSION string length overflow");
+         return NULL;
+      }
+      strcpy(h->Version, tmp);
+
+      tmp = (char *) glGetString(GL_VENDOR);
+      if (strlen(tmp) + 1 > sizeof(h->Vendor)) {
+         Error(displayName, "GL_VENDOR string length overflow");
+         return NULL;
+      }
       strcpy(h->Vendor, (char *) glGetString(GL_VENDOR));
+
+      tmp = (char *) glGetString(GL_RENDERER);
+      if (strlen(tmp) + 1 > sizeof(h->Renderer)) {
+         Error(displayName, "GL_RENDERER string length overflow");
+         return NULL;
+      }
       strcpy(h->Renderer, (char *) glGetString(GL_RENDERER));
+
       NumHeads++;
       return &Heads[NumHeads-1];
    }
-- 
2.7.4