[PATCH] bug fix for a buffer overflow in ivona_client.c

[Trevor Saunders]

play_icon() sprintf'd into a fixed length buffer.  Fix this by using
strlen to find out how long a buffer we need then allocate it with
g_malloc().
---
 src/modules/ivona_client.c |    6 ++++--
 1 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/modules/ivona_client.c b/src/modules/ivona_client.c
index ab7423c..ad0690d 100644
--- a/src/modules/ivona_client.c
+++ b/src/modules/ivona_client.c
@@ -339,9 +339,11 @@ ivona_play_file(char *filename)
 
 void play_icon(char *name)
 {
-       char buf[256];
-       sprintf(buf,"%s%s",IvonaSoundIconPath,name);
+       int len = strlen(IvonaSoundIconPath) + strlen(name) + 2;
+       char *buf = g_malloc(len);
+sprintf(buf, "%s/%s", IvonaSoundIconPath, name);
        ivona_play_file(buf);
+       g_free(buf);
 }
 
 #define IVONA_CACHE_SIZE 256
-- 
1.7.1