From d792ebc5d2feb19f697260dc7ac923f27b173139 Mon Sep 17 00:00:00 2001
From: Sean McBride <sean@rogue-research.com>
Date: Fri, 26 May 2023 07:57:31 -0400
Subject: [PATCH] Fixed buffer overrun; removed the last two uses of sprintf

Fixed an off-by-1 buffer resize, the space for the null termination was forgotten.

Prefer snprintf, which can never overflow (if given the right size).

In one case I cheated and used strcpy, because I cannot figure out the buffer size at that point in the code.
---
 modules/core/src/persistence_xml.cpp | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/modules/core/src/persistence_xml.cpp b/modules/core/src/persistence_xml.cpp
index caba4f5bf0..6141fade2d 100644
--- a/modules/core/src/persistence_xml.cpp
+++ b/modules/core/src/persistence_xml.cpp
@@ -308,8 +308,8 @@ public:
 
         if( !multiline )
         {
-            ptr = fs->resizeWriteBuffer( ptr, len + 9 );
-            sprintf( ptr, "<!-- %s -->", comment );
+            ptr = fs->resizeWriteBuffer( ptr, len + 5+4+1 );
+            snprintf( ptr, len + 5+4+1, "<!-- %s -->", comment );
             len = (int)strlen(ptr);
         }
         else
@@ -344,7 +344,7 @@ public:
                 fs->setBufferPtr(ptr);
                 ptr = fs->flush();
             }
-            sprintf( ptr, "-->" );
+            strcpy( ptr, "-->" );
             fs->setBufferPtr(ptr + 3);
             fs->flush();
         }