From: Jan Engelhardt Reference: http://bugs.icu-project.org/trac/ticket/7808 build: resolve potential buffer overflow in icu I: Statement might be overflowing a buffer in strncat. Common mistake: BAD: strncat(buffer,charptr,sizeof(buffer)) is wrong, it takes the left over size as 3rd argument GOOD: strncat(buffer,charptr,sizeof(buffer)-strlen(buffer)-1) E: icu bufferoverflowstrncat pkgdata.cpp:299:87 --- source/tools/pkgdata/pkgdata.cpp | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) Index: icu/source/tools/pkgdata/pkgdata.cpp =================================================================== --- icu.orig/source/tools/pkgdata/pkgdata.cpp 2014-06-03 13:07:41.342876943 +0200 +++ icu/source/tools/pkgdata/pkgdata.cpp 2014-06-03 13:08:45.537882879 +0200 @@ -2069,12 +2069,12 @@ const char cmd[] = "icu-config --incpkgdatafile"; /* #1 try the same path where pkgdata was called from. */ - findDirname(progname, cmdBuf, 1024, &status); + findDirname(progname, cmdBuf, sizeof(cmdBuf), &status); if(U_SUCCESS(status)) { if (cmdBuf[0] != 0) { - uprv_strncat(cmdBuf, U_FILE_SEP_STRING, 1024); + uprv_strncat(cmdBuf, U_FILE_SEP_STRING, sizeof(cmdBuf)-1-strlen(cmdBuf)); } - uprv_strncat(cmdBuf, cmd, 1023); + uprv_strncat(cmdBuf, cmd, sizeof(cmdBuf)-1-strlen(cmdBuf)); if(verbose) { fprintf(stdout, "# Calling icu-config: %s\n", cmdBuf);