dtsession/SmUI: fix tainted var (CID 88216)

2014-12-27 19:52:37 -07:00
parent db8280189d
commit aa2daba4af
1 changed files with 2 additions and 3 deletions
--- a/cde/programs/dtsession/SmUI.c
+++ b/cde/programs/dtsession/SmUI.c
@@ -907,9 +907,8 @@ CreateLockDialogWithCover(
     */
    i = 0;
    envLog = getenv("LOGNAME");
-    lockMessage = XtMalloc(100 + strlen(envLog));
-    sprintf(
-	lockMessage,
+    lockMessage = XtCalloc(1, 100 + strlen(envLog));
+    snprintf(lockMessage, 100 + strlen(envLog) - 1,
 	((char *)GETMESSAGE(18, 1, "Display locked by user %s.")), envLog);
    lockString = XmStringCreateLocalized(lockMessage);
    XtSetArg(uiArgs[i], XmNtopAttachment, XmATTACH_POSITION); i++;