From eae27ffa8ae4affa205ffae517c43efcc8d3f6b4 Mon Sep 17 00:00:00 2001
From: David Griffith <dave@661.org>
Date: Tue, 12 Feb 2019 05:16:19 -0800
Subject: [PATCH] Replace two strcat() calls in dumb interface.

---
 src/dumb/dumb_input.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/dumb/dumb_input.c b/src/dumb/dumb_input.c
index a012ae6..10b4b99 100644
--- a/src/dumb/dumb_input.c
+++ b/src/dumb/dumb_input.c
@@ -456,10 +456,12 @@ char *os_read_file_name (const char *default_name, int flag)
     }
     tempname = strdup(file_name + i);
     strncpy(file_name, f_setup.restricted_path, FILENAME_MAX);
+
+    /* Make sure the final character is the path separator. */
     if (file_name[strlen(file_name)-1] != PATH_SEPARATOR) {
-      strcat(file_name, "/");
+      strncat(file_name, "/", FILENAME_MAX - strlen(file_name) - 2);
     }
-    strcat(file_name, tempname);
+    strncat(file_name, tempname, strlen(file_name) - strlen(tempname) - 1);
   }
 
   /* Warn if overwriting a file.  */
-- 
2.34.1