powercap_ppc copying more data than destination can contain

In the test code below (powercap_basic.c) event_descrs[num_events] has a size of PAPI_MAX_STR_LEN while the source evince.long_descr has a size of PAPI_2MAX_STR_LEN. Only PAPI_MAX_STR_LEN - 1 characters are copied.

92        strncpy( event_descrs[num_events],evinfo.long_descr,sizeof( event_descrs[0] )-1 );
93        strncpy( units[num_events],evinfo.units,sizeof( units[0] )-1 );
94        // buffer must be null terminated to safely use strstr operation on it below
95        units[num_events][sizeof( units[0] )-1] = '\0';

‌

Comments (2)