From Paul Fox - don't walk past end of buf when prescanning bogus GPX.
authorrobertl <robertl@f51c46e8-681c-474f-0cfe-069cfd0219fb>
Thu, 3 Nov 2005 04:19:38 +0000 (04:19 +0000)
committerrobertl <robertl@f51c46e8-681c-474f-0cfe-069cfd0219fb>
Thu, 3 Nov 2005 04:19:38 +0000 (04:19 +0000)
gpsbabel/gpx.c

index 4e7c841f25119e82aedefd8778f252163f3c6142..2be37b87fd7813353f2dbdafb9994641d6211ad9 100644 (file)
@@ -1023,6 +1023,7 @@ gpx_read(void)
        int done = 0;
        char *buf = xmalloc(MY_CBUF_SZ);
        int result = 0;
+       int extra;
 
        while (!done) {
                if ( fd ) {
@@ -1047,7 +1048,8 @@ gpx_read(void)
                        buf[len] = '\0';
                        badchar = buf+len-maxentlength;
                        badchar = strchr( badchar, '&' );
-                       while ( badchar ) {
+                       extra = maxentlength - 1; /* for terminator */
+                       while ( badchar && len < MY_CBUF_SZ-1) {
                                int extra = maxentlength-1; /* for terminator */
                                semi = strchr( badchar, ';');
                                while ( extra && !semi ) {