From a35302ebd4b02996481da9f13838125c201a6af3 Mon Sep 17 00:00:00 2001
From: Peter Stephenson <pws@users.sourceforge.net>
Date: Mon, 2 Apr 2007 11:00:35 +0000
Subject: 23257: buffer too short for multibyte ${(#)...} evalution

---
 Src/subst.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

(limited to 'Src')

diff --git a/Src/subst.c b/Src/subst.c
index 9d6a41305..5d7a44b05 100644
--- a/Src/subst.c
+++ b/Src/subst.c
@@ -1199,10 +1199,11 @@ substevalchar(char *ptr)
 	return NULL;
 #ifdef MULTIBYTE_SUPPORT
     if (isset(MULTIBYTE) && ires > 127) {
-	char buf[10];
+	/* '\\' + 'U' + 8 bytes of character + '\0' */
+	char buf[11];
 
 	/* inefficient: should separate out \U handling from getkeystring */
-	sprintf(buf, "\\U%.8x", (unsigned int)ires);
+	sprintf(buf, "\\U%.8x", (unsigned int)ires & 0xFFFFFFFFu);
 	ptr = getkeystring(buf, &len, GETKEYS_BINDKEY, NULL);
     }
     if (len == 0)
-- 
cgit 1.4.1