- compilation fix

- note that a buffer overflow is still possible

diff --git a/format-security.patch b/format-security.patch
new file mode 100644 (file)
index 0000000..f78e5be
--- /dev/null
+++ b/format-security.patch
@@ -0,0 +1,22 @@
+--- libPropList-0.10.1/util.c.orig     2014-01-14 10:40:09.183601243 +0100
++++ libPropList-0.10.1/util.c  2014-01-14 10:41:31.031533654 +0100
+@@ -213,15 +213,15 @@ char *MakeDefaultsFilename()
+       sprintf(actual_filename, "%s/GNUstep", env);
+     }
+   else
+-    sprintf(actual_filename, env);
++    strcpy(actual_filename, env);
+ 
+-  sprintf(&(actual_filename[strlen(actual_filename)]), "/");
++  strcpy(&(actual_filename[strlen(actual_filename)]), "/");
+ 
+   env = (char *)getenv("GNUSTEP_DEFAULTS_FILE");
+   if(!env)
+-    sprintf(&(actual_filename[strlen(actual_filename)]), "Defaults");
++    strcpy(&(actual_filename[strlen(actual_filename)]), "Defaults");
+   else
+-    sprintf(&(actual_filename[strlen(actual_filename)]), env);
++    strcpy(&(actual_filename[strlen(actual_filename)]), env);
+ 
+   return ManglePath(actual_filename);
+ }