mozilla: Don't read beyond the buffer boundry

This fixes a buffer-overflow.

1 files changed, 9 insertions, 6 deletions

diff --git a/src/gclue-mozilla.c b/src/gclue-mozilla.c
index 26a9974..016ba66 100644
--- a/src/gclue-mozilla.c
+++ b/src/gclue-mozilla.c
@@ -86,13 +86,16 @@ get_bssid_from_bss (WPABSS *bss)
                 return NULL;
 
         raw_bssid = variant_to_string (variant, &raw_len);
-        len = raw_len * 2 + raw_len;
+        if (raw_bssid == NULL)
+                return NULL;
+
+        len = raw_len * 2;
         bssid = g_malloc (len);
-        for (i = 0, j = 0; i < len; i = i + 3, j++)
-                g_snprintf (bssid + i,
-                            4,
-                           "%02x:",
-                           (unsigned char) raw_bssid[j]);
+        for (i = 0, j = 0; i < len - 3; i = i + 2, j++) {
+                unsigned char c = (unsigned char) raw_bssid[j];
+
+                g_snprintf (bssid + i, 3, "%02x:", c);
+        }
         bssid[len - 1] = '\0';
 
         return bssid;