Fixed buffer overflow on String class (Paul Stoffregen)

cmaglie · cmaglie · commit f25e5e94f7cd · 2013-06-06T20:04:43.000+02:00
diff --git a/cores/arduino/WString.cpp b/cores/arduino/WString.cpp
@@ -296,14 +296,14 @@ unsigned char String::concat(unsigned char num)
 
 unsigned char String::concat(int num)
 {
-	char buf[7];
+	char buf[12];
 	itoa(num, buf, 10);
 	return concat(buf, strlen(buf));
 }
 
 unsigned char String::concat(unsigned int num)
 {
-	char buf[6];
+	char buf[11];
 	utoa(num, buf, 10);
 	return concat(buf, strlen(buf));
 }
diff --git a/cores/robot/WString.cpp b/cores/robot/WString.cpp
@@ -296,14 +296,14 @@ unsigned char String::concat(unsigned char num)
 
 unsigned char String::concat(int num)
 {
-	char buf[7];
+	char buf[12];
 	itoa(num, buf, 10);
 	return concat(buf, strlen(buf));
 }
 
 unsigned char String::concat(unsigned int num)
 {
-	char buf[6];
+	char buf[11];
 	utoa(num, buf, 10);
 	return concat(buf, strlen(buf));
 }

Original file line number	Diff line number	Diff line change
`@@ -296,14 +296,14 @@ unsigned char String::concat(unsigned char num)`
`296`	`296`
`297`	`297`	`unsigned char String::concat(int num)`
`298`	`298`	`{`
`299`		`- char buf[7];`
	`299`	`+ char buf[12];`
`300`	`300`	`itoa(num, buf, 10);`
`301`	`301`	`return concat(buf, strlen(buf));`
`302`	`302`	`}`
`303`	`303`
`304`	`304`	`unsigned char String::concat(unsigned int num)`
`305`	`305`	`{`
`306`		`- char buf[6];`
	`306`	`+ char buf[11];`
`307`	`307`	`utoa(num, buf, 10);`
`308`	`308`	`return concat(buf, strlen(buf));`
`309`	`309`	`}`