Add a cast to (unsigned char) in a sprintf argument. Otherwise,

default promotions cause "\377" = 255 = -128 to be written as
"\37777777600" instead of "\377", causing a buffer overrun.

diff --git a/server/mr_util.c b/server/mr_util.c
index 6c6e58197c49966c0d94ad3967a91a3f638f1b93..8320877d640ae4b5b54f1c2932130dc090451234 100644 (file)
--- a/server/mr_util.c
+++ b/server/mr_util.c
@@ -38,7 +38,7 @@ char *requote(char *cp)
        }
       else
        {
-         sprintf(op, "\\%03o", *cp++);
+         sprintf(op, "\\%03o", (unsigned char)*cp++);
          op += 4;
          len += 4;
        }