commit 040a9c0131fc866aa8b3ebef5531599e2d4426b2
Author: Simon Budig <simon@budig.de>
Date:   Tue Jan 11 22:40:31 2011 +0100

    fixes for some buffer overflow problems (see bug #639203)

diff --git a/plug-ins/common/sphere-designer.c b/plug-ins/common/sphere-designer.c
index 4e5b982..4d55d63 100644
--- a/plug-ins/common/sphere-designer.c
+++ b/plug-ins/common/sphere-designer.c
@@ -2005,6 +2005,13 @@ loadit (const gchar * fn)
       return;
     }
 
+#if G_ASCII_DTOSTR_BUF_SIZE == 39
+  /* 21 * (39 + 1), subtract one for terminating zero */
+# define STRTOD_21_FMT " %839s "
+#else
+# error "G_ASCII_DTOSTR_BUF_SIZE has unexpected size!"
+#endif
+
   if (2 != fscanf (f, "%d %d", &majtype, &type) || majtype < 0 || majtype > 2)
     {
       g_message (_("File '%s' is not a valid save file."),
@@ -2027,7 +2034,7 @@ loadit (const gchar * fn)
       t = &s.com.texture[i];
       setdefaults (t);
 
-      if (sscanf (line, "%d %d %s", &t->majtype, &t->type, end) != 3)
+      if (sscanf (line, "%d %d" STRTOD_21_FMT, &t->majtype, &t->type, end) != 3)
         t->color1.x = g_ascii_strtod (end, &end);
       if (end && errno != ERANGE)
         t->color1.y = g_ascii_strtod (end, &end);
diff --git a/plug-ins/gfig/gfig-style.c b/plug-ins/gfig/gfig-style.c
index ee1c7b2..bebe207 100644
--- a/plug-ins/gfig/gfig-style.c
+++ b/plug-ins/gfig/gfig-style.c
@@ -171,6 +171,13 @@ gfig_read_parameter_gimp_rgb (gchar        **text,
 
   style_entry->r = style_entry->g = style_entry->b = style_entry->a = 0.;
 
+#if G_ASCII_DTOSTR_BUF_SIZE == 39
+  /* subtract one for terminating zero */
+# define STRTOD_FMT " %38s "
+#else
+# error "G_ASCII_DTOSTR_BUF_SIZE has unexpected size!"
+#endif
+
   while (n < nitems)
     {
       ptr = strchr (text[n], ':');
@@ -180,7 +187,8 @@ gfig_read_parameter_gimp_rgb (gchar        **text,
           ptr++;
           if (!strcmp (tmpstr, name))
             {
-              sscanf (ptr, "%s %s %s %s", colorstr_r, colorstr_g, colorstr_b, colorstr_a);
+              sscanf (ptr, STRTOD_FMT STRTOD_FMT STRTOD_FMT STRTOD_FMT,
+                      colorstr_r, colorstr_g, colorstr_b, colorstr_a);
               style_entry->r = g_ascii_strtod (colorstr_r, &endptr);
               style_entry->g = g_ascii_strtod (colorstr_g, &endptr);
               style_entry->b = g_ascii_strtod (colorstr_b, &endptr);
diff --git a/plug-ins/lighting/lighting-ui.c b/plug-ins/lighting/lighting-ui.c
index 99fb348..054bade 100644
--- a/plug-ins/lighting/lighting-ui.c
+++ b/plug-ins/lighting/lighting-ui.c
@@ -1384,23 +1384,33 @@ load_preset_response (GtkFileChooser *chooser,
                   return;
                 }
 
-              fscanf (fp, " Position: %s %s %s", buffer1, buffer2, buffer3);
+#if G_ASCII_DTOSTR_BUF_SIZE == 39
+  /* subtract one for terminating zero */
+# define STRTOD_FMT " %38s "
+#else
+# error "G_ASCII_DTOSTR_BUF_SIZE has unexpected size!"
+#endif
+
+              fscanf (fp, " Position: " STRTOD_FMT STRTOD_FMT STRTOD_FMT,
+                      buffer1, buffer2, buffer3);
               source->position.x = g_ascii_strtod (buffer1, &endptr);
               source->position.y = g_ascii_strtod (buffer2, &endptr);
               source->position.z = g_ascii_strtod (buffer3, &endptr);
 
-              fscanf (fp, " Direction: %s %s %s", buffer1, buffer2, buffer3);
+              fscanf (fp, " Direction: " STRTOD_FMT STRTOD_FMT STRTOD_FMT,
+                      buffer1, buffer2, buffer3);
               source->direction.x = g_ascii_strtod (buffer1, &endptr);
               source->direction.y = g_ascii_strtod (buffer2, &endptr);
               source->direction.z = g_ascii_strtod (buffer3, &endptr);
 
-              fscanf (fp, " Color: %s %s %s", buffer1, buffer2, buffer3);
+              fscanf (fp, " Color: " STRTOD_FMT STRTOD_FMT STRTOD_FMT,
+                      buffer1, buffer2, buffer3);
               source->color.r = g_ascii_strtod (buffer1, &endptr);
               source->color.g = g_ascii_strtod (buffer2, &endptr);
               source->color.b = g_ascii_strtod (buffer3, &endptr);
               source->color.a = 1.0;
 
-              fscanf (fp, " Intensity: %s", buffer1);
+              fscanf (fp, " Intensity: " STRTOD_FMT, buffer1);
               source->intensity = g_ascii_strtod (buffer1, &endptr);
 
             }
