Immediate-Mode-UI / Nuklear

A single-header ANSI C immediate mode cross-platform GUI library
https://immediate-mode-ui.github.io/Nuklear/doc/index.html
8.89k stars 533 forks source link

Fix undefined behavior in `strncpy()` call #595

Closed LocalSpook closed 3 months ago

LocalSpook commented 7 months ago

strncpy()'s pointer parameters are marked restrict, but when file_browser_reload_directory_content() was being called to reload the directory that was currently open:

file_browser_reload_directory_content(browser, browser->directory)

it would try to copy its path buffer to itself, causing undefined behavior. The solution uses memmove(), which can handle overlapping pointers.

Found with Address Sanitizer.