fix buffer overflow in battery state parsing

"Not charging" is 12 characters; %12[a-zA-Z ] reads up to 12 chars
plus a NUL terminator (13 bytes) into a 12-byte buffer. Increase
state buffer to 13 in both battery_state and battery_remaining.

diff --git a/components/battery.c b/components/battery.c
index 1c753f903cde3de224ce37b4485de6693369790a..f2dc393bde92ee70e437606d0b7d8a24a62e4594 100644 (file)
--- a/components/battery.c
+++ b/components/battery.c
@@ -62,7 +62,7 @@
                        { "Not charging", "o" },
                };
                size_t i;
-               char path[PATH_MAX], state[12];
+               char path[PATH_MAX], state[13];
 
                if (esnprintf(path, sizeof(path), POWER_SUPPLY_STATUS, bat) < 0)
                        return NULL;
@@ -81,7 +81,7 @@
        {
                uintmax_t charge_now, current_now, m, h;
                double timeleft;
-               char path[PATH_MAX], state[12];
+               char path[PATH_MAX], state[13];
 
                if (esnprintf(path, sizeof(path), POWER_SUPPLY_STATUS, bat) < 0)
                        return NULL;