From 69c40f047eea7f950f4b64ed2ce804f4bf0cb41d Mon Sep 17 00:00:00 2001 From: Aizal Khan Date: Mon, 3 Aug 2026 18:36:03 +0530 Subject: [PATCH] bound destination writes in win32_utf8cpy Signed-off-by: Aizal Khan --- cups/dnssd.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/cups/dnssd.c b/cups/dnssd.c index c227ad4b9..08d55dbdc 100644 --- a/cups/dnssd.c +++ b/cups/dnssd.c @@ -2606,10 +2606,11 @@ win32_utf8cpy(char *dst, // I - Destination string size_t dstsize) // I - Size of destination string { int ch; // Current character + char *dstend = dst + dstsize - 5; // End of destination string // Loop until we run out of characters or buffer space... - while (*src && dstsize > 4) + while (*src && dst <= dstend) { // Get the current character... ch = *src++;