[xiphos-source] [crosswire/xiphos] 83af40: fix: replace strcpy with g_strlcpy for module_name...

[Devon Kirk]

  Branch: refs/heads/master
  Home:   https://github.com/crosswire/xiphos
  Commit: 83af400bed790f4c4083631075504972179ee278
      https://github.com/crosswire/xiphos/commit/83af400bed790f4c4083631075504972179ee278
  Author: Devon Kirk <67167176+hyder365 at users.noreply.github.com>
  Date:   2026-06-30 (Tue, 30 Jun 2026)

  Changed paths:
    M src/main/sidebar.cc

  Log Message:
  -----------
  fix: replace strcpy with g_strlcpy for module_name in sidebar (#1338)

main_display_verse_list_in_sidebar() copies module_name into two
fixed 80-byte buffers (settings.sb_search_mod[80] and
sidebar.mod_name[80]) using strcpy() with no bounds check.

When BibleSync navigation takes the indirect path (unknown module,
multi-ref, or user preference), the bible field from the UDP packet
is passed directly as module_name at biblesync_glue.cc:184.  A bible
field exceeding 80 bytes overflows both global buffers.

Replace strcpy with g_strlcpy, which always null-terminates and never
writes more than the specified buffer size.

Co-authored-by: Devon Kirk <hyder365 at users.noreply.github.com>



To unsubscribe from these emails, change your notification settings at https://github.com/crosswire/xiphos/settings/notifications