Permalink
Browse files

mapwcs: use large enough output buffer for snprintf

  • Loading branch information...
gogglesguy committed Aug 20, 2018
1 parent 9b95631 commit d18302baca4990fd4540784117152feed5560c7d
Showing with 3 additions and 3 deletions.
  1. +1 −1 mapwcs.c
  2. +2 −2 mapwcs20.c
@@ -1721,7 +1721,7 @@ static int msWCSGetCoverage(mapObj *map, cgiRequestObj *request,
outputFormatObj *format;
char *bandlist=NULL;
size_t bufferSize = 0;
char numbands[8]; /* should be large enough to hold the number of bands in the bandlist */
char numbands[12]; /* should be large enough to hold the number of bands in the bandlist */
coverageMetadataObj cm;
rectObj reqextent;
rectObj covextent;
@@ -3955,7 +3955,7 @@ static int msWCSGetCoverage20_GetBands(mapObj *map, layerObj *layer,
if(NULL == params->range_subset) {
*bandlist = msStrdup("1");
for(i = 1; i < cm->numbands; ++i) {
char strnumber[10];
char strnumber[12];
snprintf(strnumber, sizeof(strnumber), ",%d", i + 1);
*bandlist = msStringConcatenate(*bandlist, strnumber);
}
@@ -4310,7 +4310,7 @@ int msWCSGetCoverage20(mapObj *map, cgiRequestObj *request,
int status, i;
double x_1, x_2, y_1, y_2;
char *coverageName, *bandlist=NULL, numbands[8];
char *coverageName, *bandlist=NULL, numbands[12];
int doDrawRasterLayerDraw = MS_TRUE;
GDALDatasetH hDS = NULL;

0 comments on commit d18302b

Please sign in to comment.