From 1d95a137938f347c78bdefa91bde6d7e3678bba0 Mon Sep 17 00:00:00 2001
From: Mark Nudelman <markn@greenwoodsoftware.com>
Date: Fri, 1 Oct 2021 09:51:23 -0700
Subject: [PATCH] Buffer review.

---
 charset.c       | 4 ++--
 less.h          | 1 +
 lesskey_parse.c | 8 +++++---
 option.c        | 2 +-
 os.c            | 2 +-
 screen.c        | 4 ++--
 tags.c          | 2 +-
 7 files changed, 13 insertions(+), 10 deletions(-)

diff --git a/charset.c b/charset.c
index b37c8a29..50497947 100644
--- a/charset.c
+++ b/charset.c
@@ -445,7 +445,7 @@ prchar(c)
 	LWCHAR c;
 {
 	/* {{ This buffer can be overrun if LESSBINFMT is a long string. }} */
-	static char buf[32];
+	static char buf[MAX_PRCHAR_LEN+1];
 
 	c &= 0377;
 	if ((c < 128 || !utf_mode) && !control_char(c))
@@ -480,7 +480,7 @@ prchar(c)
 prutfchar(ch)
 	LWCHAR ch;
 {
-	static char buf[32];
+	static char buf[MAX_PRCHAR_LEN+1];
 
 	if (ch == ESC)
 		strcpy(buf, "ESC");
diff --git a/less.h b/less.h
index 83e31514..9be621fb 100644
--- a/less.h
+++ b/less.h
@@ -231,6 +231,7 @@ typedef off_t           LINENUM;
 #define MAX_LINENUM_WIDTH   16  /* Max width of a line number */
 #define MAX_STATUSCOL_WIDTH 4   /* Max width of the status column */
 #define MAX_UTF_CHAR_LEN    6   /* Max bytes in one UTF-8 char */
+#define MAX_PRCHAR_LEN      31  /* Max chars in prchar() result */
 
 #define NULL_POSITION   ((POSITION)(-1))
 
diff --git a/lesskey_parse.c b/lesskey_parse.c
index c7dfa9d5..382aea58 100644
--- a/lesskey_parse.c
+++ b/lesskey_parse.c
@@ -160,6 +160,8 @@ init_tables(tables)
 	xbuf_init(&tables->vartable.buf);
 }
 
+#define CHAR_STRING_LEN 8
+
 	static char *
 char_string(buf, ch)
 	char *buf;
@@ -171,7 +173,7 @@ char_string(buf, ch)
 		buf[1] = '\0';
 	} else
 	{
-		snprintf(buf, 5, "\\x%02x", ch);
+		snprintf(buf, CHAR_STRING_LEN, "\\x%02x", ch);
 	}
 	return buf;
 }
@@ -187,7 +189,7 @@ tstr(pp, xlate)
 	char *p;
 	char ch;
 	int i;
-	static char buf[10];
+	static char buf[CHAR_STRING_LEN];
 	static char tstr_control_k[] =
 		{ SK_SPECIAL_KEY, SK_CONTROL_K, 6, 1, 1, 1, '\0' };
 
@@ -399,7 +401,7 @@ version_line(s, tables)
 	char op;
 	int ver;
 	char *e;
-	char buf[8];
+	char buf[CHAR_STRING_LEN];
 
 	s += strlen("#version");
 	s = skipsp(s);
diff --git a/option.c b/option.c
index 61247d81..687444e9 100644
--- a/option.c
+++ b/option.c
@@ -55,7 +55,7 @@ opt_desc(o)
 propt(c)
 	int c;
 {
-	static char buf[8];
+	static char buf[MAX_PRCHAR_LEN+2];
 
 	sprintf(buf, "-%s", prchar(c));
 	return (buf);
diff --git a/os.c b/os.c
index 6c784d61..92cb798c 100644
--- a/os.c
+++ b/os.c
@@ -259,7 +259,7 @@ get_time(VOID_PARAM)
 strerror(err)
 	int err;
 {
-	static char buf[16];
+	static char buf[INT_STRLEN_BOUND(int)+12];
 #if HAVE_SYS_ERRLIST
 	extern char *sys_errlist[];
 	extern int sys_nerr;
diff --git a/screen.c b/screen.c
index 02a9101e..578d345b 100644
--- a/screen.c
+++ b/screen.c
@@ -2547,7 +2547,7 @@ tput_fmt(fmt, color, f_putc)
 	int color;
 	int (*f_putc)(int);
 {
-	char buf[32];
+	char buf[INT_STRLEN_BOUND(int)+16];
 	if (color == attrcolor)
 		return;
 	SNPRINTF1(buf, sizeof(buf), fmt, color);
@@ -2628,7 +2628,7 @@ WIN32put_fmt(fmt, color)
 	char *fmt;
 	int color;
 {
-	char buf[16];
+	char buf[INT_STRLEN_BOUND(int)+16];
 	int len = SNPRINTF1(buf, sizeof(buf), fmt, color);
 	WIN32textout(buf, len);
 	return TRUE;
diff --git a/tags.c b/tags.c
index 23a9b92f..1244c35b 100644
--- a/tags.c
+++ b/tags.c
@@ -508,7 +508,7 @@ findgtag(tag, type)
 	char *tag;              /* tag to load */
 	int type;               /* tags type */
 {
-	char buf[256];
+	char buf[1024];
 	FILE *fp;
 	struct tag *tp;