[dia/dia-0-97] Bug 709017 [warningectomy] array subscript is above array bounds

[Hans Breuer <hans src gnome org>]

commit 80f95dfaeb92c44e49e51b8a69e301ea879b846b
Author: Hans Breuer <hans breuer org>
Date:   Thu Oct 3 20:04:37 2013 +0200

    Bug 709017 [warningectomy] array subscript is above array bounds
    
    Get rid of the temporary array for font name, loose the limitation
    of maximum font name length and spare a string copy.

 lib/dia_svg.c |   82 +++++++++++++++-----------------------------------------
 1 files changed, 22 insertions(+), 60 deletions(-)
---
diff --git a/lib/dia_svg.c b/lib/dia_svg.c
index eea21b2..4eec0d0 100644
--- a/lib/dia_svg.c
+++ b/lib/dia_svg.c
@@ -127,11 +127,6 @@ _parse_color(gint32 *color, const char *str)
   return TRUE;
 }
 
-enum
-{
-  FONT_NAME_LENGTH_MAX = 40
-};
-
 /** This function not only parses the style attribute of the given node
  *  it also extracts some of the style properties directly.
  * @param node An XML node to parse a style from.
@@ -144,9 +139,7 @@ void
 dia_svg_parse_style(xmlNodePtr node, DiaSvgStyle *s, real user_scale)
 {
   xmlChar *str;
-  gchar temp[FONT_NAME_LENGTH_MAX+1]; /* font-family names will be limited to 40 characters */
   int i = 0;
-  gboolean over = FALSE;
   char *family = NULL, *style = NULL, *weight = NULL;
 
   str = xmlGetProp(node, (const xmlChar *)"style");
@@ -161,68 +154,37 @@ dia_svg_parse_style(xmlNodePtr node, DiaSvgStyle *s, real user_scale)
       if (!strncmp("font-family:", ptr, 12)) {
        ptr += 12;
        while ((ptr[0] != '\0') && g_ascii_isspace(ptr[0])) ptr++;
-       i = 0; over = FALSE;
-       while (ptr[0] != '\0' && ptr[0] != ';' && !over) {
-         if (i < FONT_NAME_LENGTH_MAX) {
-           temp[i] = ptr[0];
-         } else over = TRUE;
-         i++;
-         ptr++;
-       }
-       temp[i] = '\0';
-
-       if (!over) {
-         if (strcmp (temp, "sanserif") == 0 || strcmp (temp, "sans-serif") == 0)
-           family = g_strdup ("sans"); /* special name adaption */
-         else
-           family = g_strdup(temp);
-       }
+       i = 0;
+       while (ptr[i] != '\0' && ptr[i] != ';')  ++i;
+       /* with i==0 we fall back to 'sans' too */
+       if (strncmp (ptr, "sanserif", i) == 0 || strncmp (ptr, "sans-serif", i) == 0)
+         family = g_strdup ("sans"); /* special name adaption */
+       else
+         family = i > 0 ? g_strndup(ptr, i) : NULL;
+       ptr += i;
       } else if (!strncmp("font-weight:", ptr, 12)) {
        ptr += 12;
        while ((ptr[0] != '\0') && g_ascii_isspace(ptr[0])) ptr++;
-       i = 0; over = FALSE;
-       while (ptr[0] != '\0' && ptr[0] != ';' && !over) {
-         if (i < FONT_NAME_LENGTH_MAX) {
-           temp[i] = ptr[0];
-         } else over = TRUE;
-         i++;
-         ptr++;
-       }
-       temp[i] = '\0';
-
-       if (!over) weight = g_strdup(temp);
+       i = 0;
+       while (ptr[i] != '\0' && ptr[i] != ';') ++i;
+       weight = i > 0 ? g_strndup (ptr, i) : NULL;
+       ptr += i;
       } else if (!strncmp("font-style:", ptr, 11)) {
        ptr += 11;
        while ((ptr[0] != '\0') && g_ascii_isspace(ptr[0])) ptr++;
-       i = 0; over = FALSE;
-       while (ptr[0] != '\0' && ptr[0] != ';' && !over) {
-         if (i < FONT_NAME_LENGTH_MAX) {
-           temp[i] = ptr[0];
-         } else over = TRUE;
-         i++;
-         ptr++;
-       }
-       temp[i] = '\0';
-
-       if (!over) style = g_strdup(temp);
+       i = 0;
+       while (ptr[i] != '\0' && ptr[i] != ';') ++i;
+       style = i > 0 ? g_strndup(ptr, i) : NULL;
+       ptr += i;
       } else if (!strncmp("font-size:", ptr, 10)) {
        ptr += 10;
        while ((ptr[0] != '\0') && g_ascii_isspace(ptr[0])) ptr++;
-       i = 0; over = FALSE;
-       while (ptr[0] != '\0' && ptr[0] != ';' && !over) {
-         if (i < FONT_NAME_LENGTH_MAX) {
-           temp[i] = ptr[0];
-         } else over = TRUE;
-         i++;
-         ptr++;
-       }
-       temp[i] = '\0';
-
-       if (!over) {
-         s->font_height = g_ascii_strtod(temp, NULL);
-         if (user_scale > 0)
-           s->font_height /= user_scale;
-       }
+       i = 0;
+       while (ptr[i] != '\0' && ptr[i] != ';') ++i;
+       s->font_height = g_ascii_strtod(ptr, NULL);
+       ptr += i;
+       if (user_scale > 0)
+         s->font_height /= user_scale;
       } else if (!strncmp("text-anchor:", ptr, 12)) {
        ptr += 12;
        while ((ptr[0] != '\0') && g_ascii_isspace(ptr[0])) ptr++;