Various buffer overflow fixes

2 files changed, 5 insertions, 4 deletions

diff --git a/bat_tray.c b/bat_tray.c
index 3d01b85..a848278 100644
--- a/bat_tray.c
+++ b/bat_tray.c
@@ -144,6 +144,7 @@ static void update_tooltip_cache()
 			break;
 	}
 	strncpy(tooltip_text, msg, sizeof(tooltip_text));
+	tooltip_text[sizeof(tooltip_text)-1] = '\0';
 }
 
 
diff --git a/tray.c b/tray.c
index 696d6b8..a8a0b54 100644
--- a/tray.c
+++ b/tray.c
@@ -157,10 +157,10 @@ static gboolean show_tooltip(GtkStatusIcon* status_icon, gint x, gint y, gboolea
  **********************************************************************/
 static void update_tooltip_cache()
 {
-	char msg[1024], label[1024];
+	char msg[10240], label[1024];
 	char current_governor[20]; // TO DO
 	unsigned int i = 0;
-	int offset = 0;
+	unsigned int offset = 0;
 
 	memset(current_governor, '\0', sizeof(current_governor) );
 
@@ -171,11 +171,11 @@ static void update_tooltip_cache()
 	for(i = 0; i < gc_number(); i++)
 	{
 		gf_get_frequency_label(label, sizeof(label), gf_current(i));
-		offset += snprintf(msg+offset, sizeof(msg), _("CPU%d: %s%s"), i, label, i == gc_number()-1 ? "" : "\n");
+		offset += snprintf(msg+offset, sizeof(msg)-offset, _("CPU%d: %s%s"), i, label, i == gc_number()-1 ? "" : "\n");
 	}
 
 	strncpy(tooltip_text, msg, sizeof(tooltip_text));
-	tooltip_text[sizeof(tooltip_text)] = '\0';
+	tooltip_text[sizeof(tooltip_text)-1] = '\0';
 }