New upstream release 15.7a, fixing CVE-2009-014815.7a-1

1 files changed, 2 insertions, 2 deletions

diff --git a/src/find.c b/src/find.c
index f6a6387..89d40ea 100644
--- a/src/find.c
+++ b/src/find.c
@@ -48,7 +48,7 @@
 #endif
 #include <regex.h>
 
-static char const rcsid[] = "$Id: find.c,v 1.20 2006/08/20 19:15:54 broeker Exp $";
+static char const rcsid[] = "$Id: find.c,v 1.21 2009/04/10 13:39:23 broeker Exp $";
 
 /* most of these functions have been optimized so their innermost loops have
  * only one test for the desired character by putting the char and 
@@ -673,7 +673,7 @@ findinit(char *pattern)
 		/* must be an exact match */
 		/* note: regcomp doesn't recognize ^*keypad$ as a syntax error
 		         unless it is given as a single arg */
-		(void) sprintf(buf, "^%s$", s);
+		(void) snprintf(buf, sizeof(buf), "^%s$", s);
 		if (regcomp (&regexp, buf, REG_EXTENDED | REG_NOSUB) != 0) {
 			return(REGCMPERROR);
 		}