Fix bug in strndup implementation

The strlen() could go past the n bytes and into a memory address we
don't have read access to.

1 files changed, 6 insertions, 2 deletions

diff --git a/util/cairo-missing/strndup.c b/util/cairo-missing/strndup.c
index 280ea3017..049802b76 100644
--- a/util/cairo-missing/strndup.c
+++ b/util/cairo-missing/strndup.c
@@ -37,15 +37,19 @@ char *
 strndup (const char *s,
 	 size_t      n)
 {
+    const char *end;
     size_t len;
     char *sdup;
 
     if (s == NULL)
 	return NULL;
 
-    len = strlen (s);
-    if (len > n)
+    end = memchr (s, 0, n);
+    if (end)
+	len = end - s;
+    else
 	len = n;
+
     sdup = (char *) _cairo_malloc (len + 1);
     if (sdup != NULL) {
 	memcpy (sdup, s, len);