Revision 363a37d5 audio/audio.c

b/audio/audio.c
211 211
        size_t i;
212 212
        char *u = r + sizeof (qemu_prefix) - 1;
213 213

  
214
        strcpy (r, qemu_prefix);
215
        strcat (r, s);
214
        pstrcpy (r, len + sizeof (qemu_prefix), qemu_prefix);
215
        pstrcat (r, len, s);
216 216

  
217 217
        for (i = 0; i < len; ++i) {
218 218
            u[i] = toupper (u[i]);
......
430 430
{
431 431
    char *optname;
432 432
    const char qemu_prefix[] = "QEMU_";
433
    size_t preflen;
433
    size_t preflen, optlen;
434 434

  
435 435
    if (audio_bug (AUDIO_FUNC, !prefix)) {
436 436
        dolog ("prefix = NULL\n");
......
458 458
        /* len of opt->name + len of prefix + size of qemu_prefix
459 459
         * (includes trailing zero) + zero + underscore (on behalf of
460 460
         * sizeof) */
461
        optname = qemu_malloc (len + preflen + sizeof (qemu_prefix) + 1);
461
        optlen = len + preflen + sizeof (qemu_prefix) + 1;
462
        optname = qemu_malloc (optlen);
462 463
        if (!optname) {
463 464
            dolog ("Could not allocate memory for option name `%s'\n",
464 465
                   opt->name);
465 466
            continue;
466 467
        }
467 468

  
468
        strcpy (optname, qemu_prefix);
469
        pstrcpy (optname, optlen, qemu_prefix);
470
        optlen -= preflen;
469 471

  
470 472
        /* copy while upper-casing, including trailing zero */
471 473
        for (i = 0; i <= preflen; ++i) {
472 474
            optname[i + sizeof (qemu_prefix) - 1] = toupper (prefix[i]);
473 475
        }
474
        strcat (optname, "_");
475
        strcat (optname, opt->name);
476
        pstrcat (optname, optlen, "_");
477
        optlen--;
478
        pstrcat (optname, optlen, opt->name);
479
        optlen -= len;
476 480

  
477 481
        def = 1;
478 482
        switch (opt->tag) {

Also available in: Unified diff