From 1b8e0929d11ac89fb3d203e7bd41b9ab2d4e91eb Mon Sep 17 00:00:00 2001 From: cinnaboot Date: Sat, 17 Jan 2026 18:45:03 -0500 Subject: [PATCH] Improve buffer safety in body list string construction Use snprintf with offset tracking instead of strcat to prevent potential buffer overflow when building body list string for raygui. --- src/renderer.cpp | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/src/renderer.cpp b/src/renderer.cpp index ba8d138..755671b 100644 --- a/src/renderer.cpp +++ b/src/renderer.cpp @@ -377,16 +377,18 @@ void render_body_list_ui(SimulationState* sim, RenderState* render_state) { Rectangle panel_bounds = { (float)panel_x, (float)panel_y, (float)panel_width, (float)panel_height }; // Create body list string for raygui (NULL-terminated) - char* body_list_text = (char*)malloc(sim->body_count * 64); // 64 chars per name max + int buffer_size = sim->body_count * (64 + 1) + 1; + char* body_list_text = (char*)malloc(buffer_size); if (!body_list_text) return; - body_list_text[0] = '\0'; // Initialize empty string + body_list_text[0] = '\0'; + int offset = 0; for (int i = 0; i < sim->body_count; i++) { if (i > 0) { - strcat(body_list_text, ";"); // Separator for raygui + offset += snprintf(body_list_text + offset, buffer_size - offset, ";"); } - strcat(body_list_text, sim->bodies[i].name); + offset += snprintf(body_list_text + offset, buffer_size - offset, "%s", sim->bodies[i].name); } // Draw window