Modified Files:

	src/Cockpit/hud.cxx src/Cockpit/hud.hxx
	src/Cockpit/hud_labl.cxx src/Instrumentation/HUD/HUD_label.cxx:
	Olaf Flebbe: avoid potential buffer overflows.

diff --git a/src/Cockpit/hud.cxx b/src/Cockpit/hud.cxx
index 88597d5dc3376484fe73fe227427190f99b36958..5a2bfc48f2f7d3e4ec57583aeeff0ee4a1f0aeb1 100644 (file)
--- a/src/Cockpit/hud.cxx
+++ b/src/Cockpit/hud.cxx
@@ -553,7 +553,7 @@ void fgTextList::draw()
 
     Font->begin();
     for (; curString != lastString; curString++)
-        curString->Draw(Font,curString->digit);
+        curString->Draw(Font);
     Font->end();
 
     glDisable(GL_TEXTURE_2D);

diff --git a/src/Cockpit/hud.hxx b/src/Cockpit/hud.hxx
index 8556e4b240f21120beea04d35ab2c6aed2c7a753..377a1ae535965b19b56b550a82a92c9ff50f9604 100644 (file)
--- a/src/Cockpit/hud.hxx
+++ b/src/Cockpit/hud.hxx
@@ -233,26 +233,22 @@ extern float HUD_matrix[16];
 class fgText {
 private:
     float x, y;
-    char msg[64];
+    string msg;
+       bool digit;
+    // seems unused   
+       
 public:
-    int digit;
-    fgText(float x = 0, float y = 0, char *c = NULL,int digits=0): x(x), y(y)
-    {
-        strcpy(msg,c);
-        digit=digits;
-    }
+       fgText(float x, float y, const string& c, bool digits=false): x(x), y(y), msg( c), digit( digits) {};   
 
     fgText( const fgText & image )
-        : x(image.x), y(image.y),digit(image.digit) { strcpy(msg,image.msg); }
-
-    fgText& operator = ( const fgText & image ) {  // seems unused
-        strcpy(msg,image.msg); x = image.x; y = image.y;digit=image.digit;
-        return *this;
-    }
-
-    ~fgText() { msg[0]='\0'; }  // used but useless
-
-    int getStringWidth ( char *str )
+               : x(image.x), y(image.y),digit(image.digit), msg( image.msg) { }
+
+       fgText& operator = ( const fgText & image ) {
+               x = image.x; y = image.y; msg= image.msg; digit = image.digit;
+               return *this;
+       }
+       
+    static int getStringWidth ( const char *str )
     {
         if ( HUDtext && str ) {
             float r, l ;
@@ -262,11 +258,11 @@ public:
         return 0 ;
     }
 
-    int StringWidth (void )
+    int StringWidth ()
     {
-        if ( HUDtext && strlen( msg )) {
+        if ( HUDtext && msg != "") {
             float r, l ;
-            HUD_Font->getBBox ( msg, HUD_TextSize, 0, &l, &r, NULL, NULL ) ;
+            HUD_Font->getBBox ( msg.c_str(), HUD_TextSize, 0, &l, &r, NULL, NULL ) ;
             return float_to_int( r - l );
         }
         return 0 ;
@@ -276,56 +272,50 @@ public:
     // according to MIL Standards for example Altitude above 10000 ft
     // is shown as 10ooo.
 
-    void Draw(fntRenderer *fnt,int digits) {
-        if (digits==1) {
+    void Draw(fntRenderer *fnt) {
+        if (digit) {
             int c=0,i=0;
-            char *t=msg;
+            
             int p=4;
 
-            if (t[0]=='-') {
+            if (msg[0]=='-') {
                 //if negative value then increase the c and p values
                 //for '-' sign.  c++;
                 p++;
             }
-            char *tmp=msg;
-            while (tmp[i]!='\0') {
-                if ((tmp[i]>='0') && (tmp[i]<='9'))
+                       
+                       for (string::size_type i = 0; i < msg.size(); i++) {
+                if ((msg[i]>='0') && (msg[i]<='9'))
                     c++;
-                i++;
             }
             float orig_size = fnt->getPointSize();
             if (c>p) {
                 fnt->setPointSize(HUD_TextSize * 0.8);
-                int p1=c-3;
-                char *tmp1=msg+p1;
-                int p2=p1*8;
+                int p2=(c-3)*8;  //advance to the last 3 digits
 
                 fnt->start2f(x+p2,y);
-                fnt->puts(tmp1);
+                fnt->puts(msg.c_str() + c - 3); // display last 3 digits
 
                 fnt->setPointSize(HUD_TextSize * 1.2);
-                char tmp2[64];
-                strncpy(tmp2,msg,p1);
-                tmp2[p1]='\0';
-
+              
                 fnt->start2f(x,y);
-                fnt->puts(tmp2);
+                               fnt->puts(msg.substr(0,c-3).c_str());
             } else {
                 fnt->setPointSize(HUD_TextSize * 1.2);
                 fnt->start2f( x, y );
-                fnt->puts(tmp);
+                fnt->puts(msg.c_str());
             }
             fnt->setPointSize(orig_size);
         } else {
-            //if digits not equal to 1
+            //if digits not true
             fnt->start2f( x, y );
-            fnt->puts( msg ) ;
+            fnt->puts( msg.c_str()) ;
         }
     }
 
     void Draw()
     {
-        guiFnt.drawString( msg, float_to_int(x), float_to_int(y) );
+               guiFnt.drawString( msg.c_str(), float_to_int(x), float_to_int(y) );
     }
 };
 
@@ -334,7 +324,7 @@ class fgLineList {
 public:
     fgLineList( void ) {}
     void add( const fgLineSeg2D& seg ) { List.push_back(seg); }
-    void erase( void ) { List.erase( List.begin(), List.end() ); }
+       void erase( void ) { List.clear();}
     void draw( void ) {
         glBegin(GL_LINES);
         for_each( List.begin(), List.end(), DrawLineSeg2D());
@@ -350,7 +340,7 @@ public:
 
     void setFont( fntRenderer *Renderer ) { Font = Renderer; }
     void add( const fgText& String ) { List.push_back(String); }
-    void erase( void ) { List.erase( List.begin(), List.end() ); }
+    void erase( void ) { List.clear(); }
     void draw( void );
 };
 
@@ -452,7 +442,7 @@ public:
     {
         HUD_StippleLineList.add(fgLineSeg2D(x1,y1,x2,y2));
     }
-    void TextString( char *msg, float x, float y,int digit )
+    void TextString( char *msg, float x, float y, bool digit )
     {
         HUD_TextList.add(fgText(x, y, msg,digit));
     }
@@ -466,17 +456,7 @@ public:
         return 0 ;
     }
 
-    //code to draw ticks as small circles
-    void drawOneCircle(float x1, float y1, float r)
-    {
-        glBegin(GL_LINE_LOOP);  // Use polygon to approximate a circle
-        for (int count=0; count<25; count++) {
-            float cosine = r * cos(count * 2 * SG_PI/10.0);
-            float sine =   r * sin(count * 2 * SG_PI/10.0);
-            glVertex2f(cosine+x1, sine+y1);
-        }
-        glEnd();
-    }
+
 
 };
 
@@ -501,12 +481,11 @@ extern int HUD_style;
 class instr_label : public instr_item {
 private:
     const char  *pformat;
-    const char  *pre_str;
-    const char  *post_str;
+    
     fgLabelJust justify;
     int         fontSize;
     int         blink;
-    char        format_buffer[80];
+    string      format_buffer;
     bool        lat;
     bool        lon;
     bool        lbox;

diff --git a/src/Cockpit/hud_labl.cxx b/src/Cockpit/hud_labl.cxx
index 320e85fd6116d73a7c61ccb6d8ce45350859033c..ac829c667bf6441ba5f0e01a6eaef34e0339aaac 100644 (file)
--- a/src/Cockpit/hud_labl.cxx
+++ b/src/Cockpit/hud_labl.cxx
@@ -25,8 +25,6 @@ instr_label::instr_label(const SGPropertyNode *node) :
             node->getBoolValue("working", true),
             node->getIntValue("digits")),
     pformat(node->getStringValue("label_format")),
-    pre_str(node->getStringValue("pre_label_string")),
-    post_str(node->getStringValue("post_label_string")),
     fontSize(fgGetInt("/sim/startup/xsize") > 1000 ? HUD_FONT_LARGE : HUD_FONT_SMALL), // FIXME
     blink(node->getIntValue("blinking")),
     lat(node->getBoolValue("latitude", false)),
@@ -48,32 +46,24 @@ instr_label::instr_label(const SGPropertyNode *node) :
     else if (just == 2)
         justify = RIGHT_JUST;
 
-    if (!strcmp(pre_str, "NULL"))
-        pre_str = NULL;
-    else if (!strcmp(pre_str, "blank"))
+       string pre_str(node->getStringValue("pre_label_string"));
+       if (pre_str== "NULL")
+               pre_str.clear();
+       else if (pre_str == "blank")
         pre_str = " ";
 
-    const char *units = strcmp(fgGetString("/sim/startup/units"), "feet") ? " m" : " ft";  // FIXME
+       const char *units = strcmp(fgGetString("/sim/startup/units"), "feet") ? " m" : " ft";  // FIXME
 
-    if (!strcmp(post_str, "blank"))
+    string post_str(node->getStringValue("post_label_string"));
+    if (post_str== "NULL")
+               post_str.clear();
+       else if (post_str == "blank")
         post_str = " ";
-    else if (!strcmp(post_str, "NULL"))
-        post_str = NULL;
-    else if (!strcmp(post_str, "units"))
+       else if (post_str == "units")
         post_str = units;
 
-
-    if (pre_str != NULL) {
-        if (post_str != NULL)
-            sprintf(format_buffer, "%s%s%s", pre_str, pformat, post_str);
-        else
-            sprintf(format_buffer, "%s%s", pre_str, pformat);
-
-    } else if (post_str != NULL) {
-            sprintf(format_buffer, "%s%s", pformat, post_str);
-    } else {
-            strcpy(format_buffer, pformat);                    // FIXME
-    }
+       format_buffer = pre_str + pformat;
+       format_buffer += post_str;
 }
 
 
@@ -84,11 +74,12 @@ void instr_label::draw(void)
     int lenstr;
     RECT scrn_rect = get_location();
 
+       memset( label_buffer, 0, sizeof( label_buffer));
     if (data_available()) {
         if (lat)
-            snprintf(label_buffer, 80, format_buffer, lat_node->getStringValue());
+            snprintf(label_buffer, sizeof( label_buffer)-1, format_buffer.c_str(), lat_node->getStringValue());
         else if (lon)
-            snprintf(label_buffer, 80, format_buffer, lon_node->getStringValue());
+            snprintf(label_buffer, sizeof( label_buffer)-1, format_buffer.c_str(), lon_node->getStringValue());
         else {
             if (lbox) {// Box for label
                 float x = scrn_rect.left;
@@ -119,11 +110,11 @@ void instr_label::draw(void)
                 glDisable(GL_LINE_STIPPLE);
                 glPopMatrix();
             }
-            sprintf(label_buffer, format_buffer, get_value() * data_scaling());
+            snprintf(label_buffer, sizeof(label_buffer)-1, format_buffer.c_str(), get_value() * data_scaling());
         }
 
     } else {
-        sprintf(label_buffer, format_buffer);
+        snprintf(label_buffer, sizeof( label_buffer) -1, format_buffer.c_str());
     }
 
     lenstr = getStringWidth(label_buffer);

diff --git a/src/Instrumentation/HUD/HUD_label.cxx b/src/Instrumentation/HUD/HUD_label.cxx
index eb7d979f20402aa2f721aad8fb3399e879f076b7..431b8ae985e244263aef2151d6fe70980fb522eb 100644 (file)
--- a/src/Instrumentation/HUD/HUD_label.cxx
+++ b/src/Instrumentation/HUD/HUD_label.cxx
@@ -142,7 +142,8 @@ void HUD::Label::draw(void)
     }
 
     const int BUFSIZE = 256;
-    char buf[BUFSIZE];
+    char buf[BUFSIZE+1];
+       buf[ BUFSIZE] = '\0';  // Be sure to terminate properly
     if (_mode == NONE)
         snprintf(buf, BUFSIZE, _format.c_str());
     else if (_mode == STRING)