Added buffer size checks to the rgba_to_string() function

src/CanvasRenderingContext2d.cc

@@ -1123,7 +1123,7 @@ Context2d::GetShadowColor(Local<String> prop, const AccessorInfo &info) {
   HandleScope scope;
   char buf[64];
   Context2d *context = ObjectWrap::Unwrap<Context2d>(info.This());
-  rgba_to_string(context->state->shadow, buf);
+  rgba_to_string(context->state->shadow, buf, sizeof(buf));
   return scope.Close(String::New(buf));
 }
 
@@ -1154,7 +1154,7 @@ Context2d::GetFillColor(Local<String> prop, const AccessorInfo &info) {
   HandleScope scope;
   char buf[64];
   Context2d *context = ObjectWrap::Unwrap<Context2d>(info.This());
-  rgba_to_string(context->state->fill, buf);
+  rgba_to_string(context->state->fill, buf, sizeof(buf));
   return scope.Close(String::New(buf));
 }
 
@@ -1185,7 +1185,7 @@ Context2d::GetStrokeColor(Local<String> prop, const AccessorInfo &info) {
   HandleScope scope;
   char buf[64];
   Context2d *context = ObjectWrap::Unwrap<Context2d>(info.This());
-  rgba_to_string(context->state->stroke, buf);
+  rgba_to_string(context->state->stroke, buf, sizeof(buf));
   return scope.Close(String::New(buf));
 }
 

src/color.cc

@@ -243,14 +243,14 @@ rgba_create(uint32_t rgba) {
  */
 
 void
-rgba_to_string(rgba_t rgba, char *buf) {
+rgba_to_string(rgba_t rgba, char *buf, size_t buf_size) {
   if (1 == rgba.a) {
-    sprintf(buf, "#%.2x%.2x%.2x"
+    snprintf(buf, buf_size, "#%.2x%.2x%.2x"
       , (int) (rgba.r * 255)
       , (int) (rgba.g * 255)
       , (int) (rgba.b * 255));
   } else {
-    sprintf(buf, "rgba(%d, %d, %d, %.2f)"
+    snprintf(buf, buf_size, "rgba(%d, %d, %d, %.2f)"
       , (int) (rgba.r * 255)
       , (int) (rgba.g * 255)
       , (int) (rgba.b * 255)

src/color.h

@@ -11,6 +11,7 @@
 #include <stdio.h>
 #include <stdint.h>
 #include <string.h>
+#include <stddef.h>
 
 /*
  * RGBA struct.
@@ -31,7 +32,7 @@ int32_t
 rgba_from_string(const char *str, short *ok);
 
 void
-rgba_to_string(rgba_t rgba, char *buf);
+rgba_to_string(rgba_t rgba, char *buf, size_t buf_size);
 
 void
 rgba_inspect(int32_t rgba);