Fix buffer overruns

git-svn-id: http://svn.code.sf.net/p/netpbm/code/trunk@3846 9d0c8265-081b-0410-96cb-a4ca84ce46f8

1 files changed, 8 insertions, 6 deletions

diff --git a/converter/ppm/ppmtompeg/param.c b/converter/ppm/ppmtompeg/param.c
index 84104dcb..9499b4ea 100644
--- a/converter/ppm/ppmtompeg/param.c
+++ b/converter/ppm/ppmtompeg/param.c
@@ -307,13 +307,13 @@ expandBackTickLine(const char *         const input,
                    struct inputSource * const inputSourceP) {
 
     FILE *fp;
-    char cmd[300];
+    const char * cmd;
     const char * start;
     const char * end;
-    char cdcmd[110];
+    const char * cdcmd;
 
     start = &input[1];
-    end = &input[strlen(input)-1];
+    end   = &input[strlen(input)-1];
 
     while (*end != '`') {
         end--;
@@ -322,14 +322,14 @@ expandBackTickLine(const char *         const input,
     end--;
 
     if (optionSeen[OPTION_INPUT_DIR])
-        sprintf(cdcmd,"cd %s;",currentPath);
+        pm_asprintf(&cdcmd,"cd %s;", currentPath);
     else
-        strcpy(cdcmd,"");
+        cdcmd = pm_strdup("");
 
     {
         char tmp[300];
         strncpy(tmp,start,end-start+1);
-        sprintf(cmd,"(%s %s)", cdcmd, tmp);
+        pm_asprintf(&cmd, "(%s %s)", cdcmd, tmp);
     }
 
     fp = popen(cmd, "r");
@@ -343,6 +343,8 @@ expandBackTickLine(const char *         const input,
 
         mergeInputSource(inputSourceP, &subInputSource);
     }
+    pm_strfree(cmd);
+    pm_strfree(cdcmd);
 }