MrMonopoly/raylib
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[rtext] Fix buffer overflow in TextReplaceBetween()

Browse Source 
The MAX_TEXT_BUFFER_LENGTH guard present in TextReplace()/TextInsert() was
missing here, so the three strncpy() calls could write past the 1024-byte
static buffer for long inputs. Add the same length check before copying.
This commit is contained in:
Brandon Arrendondo 2026-06-23 19:48:22 -04:00
parent 962bbfc6bf
commit 99936bcb88
1 changed files with 7 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
src/rtext.c
View File

@ -1919,9 +1919,13 @@ char *TextReplaceBetween(const char *text, const char *begin, const char *end, c
int replaceLen = (replacement == NULL)? 0 : TextLength(replacement); int replaceLen = (replacement == NULL)? 0 : TextLength(replacement);
//int toreplaceLen = endIndex - beginIndex - beginLen; //int toreplaceLen = endIndex - beginIndex - beginLen;
strncpy(buffer, text, beginIndex + beginLen); // Copy first text part if ((beginIndex + beginLen + replaceLen + (textLen - endIndex)) < (MAX_TEXT_BUFFER_LENGTH - 1))
if (replacement != NULL) strncpy(buffer + beginIndex + beginLen, replacement, replaceLen); // Copy replacement (if provided) {
strncpy(buffer + beginIndex + beginLen + replaceLen, text + endIndex, textLen - endIndex); // Copy end text part strncpy(buffer, text, beginIndex + beginLen); // Copy first text part
if (replacement != NULL) strncpy(buffer + beginIndex + beginLen, replacement, replaceLen); // Copy replacement (if provided)
strncpy(buffer + beginIndex + beginLen + replaceLen, text + endIndex, textLen - endIndex); // Copy end text part
}
else TRACELOG(LOG_WARNING, "TEXT: Text with replaced string is longer than internal buffer (MAX_TEXT_BUFFER_LENGTH)");
} }
} }
} }