make image content handlers title setting use the heap instead of the stack and remove the possibility of buffer overruns

1 files changed, 10 insertions, 5 deletions

diff --git a/image/gif.c b/image/gif.c
index a33f56200..704c9710b 100644
--- a/image/gif.c
+++ b/image/gif.c
@@ -242,7 +242,7 @@ static bool nsgif_convert(struct content *c)
 	union content_msg_data msg_data;
 	const char *data;
 	unsigned long size;
-	char title[512];
+	char *title;
 
 	/* Get the animation */
 	data = content__get_source_data(c, &size);
@@ -275,14 +275,19 @@ static bool nsgif_convert(struct content *c)
 		return false;
 	}
 
-	/* Store our content width and description */
+	/* Store our content width, height and calculate size */
 	c->width = gif->gif->width;
 	c->height = gif->gif->height;
-	snprintf(title, sizeof(title), messages_get("GIFTitle"),
+	c->size += (gif->gif->width * gif->gif->height * 4) + 16 + 44;
+
+	/* set title text */
+	title = messages_get_buff("GIFTitle",
 			nsurl_access_leaf(llcache_handle_get_url(c->llcache)),
 			c->width, c->height);
-	content__set_title(c, title);
-	c->size += (gif->gif->width * gif->gif->height * 4) + 16 + 44;
+	if (title != NULL) {
+		content__set_title(c, title);
+		free(title);
+	}
 
 	/* Schedule the animation if we have one */
 	gif->current_frame = 0;