commit 7bb756c1cc580380c689a9141b27e20c7a5d95f3
author Jorg Brown <jorg@google.com> Sat Jun 18 19:22:47 2022 -0700
committer Jorg Brown <jorg@google.com> Sat Jun 18 19:22:47 2022 -0700
tree c50c3a868e65aec28021c8f84f20a50f45e6e3a5
parent 24d0a3bed154c46d3bb3f9138540e7b237f98bb2

Re-instate commit c0fc2e881bc36aafb0bf539bf41889611370f60c

src/google/protobuf/stubs/strutil.cc

diff --git a/src/google/protobuf/stubs/strutil.cc b/src/google/protobuf/stubs/strutil.cc
index 594c8ea..8e9b398 100644
--- a/src/google/protobuf/stubs/strutil.cc
+++ b/src/google/protobuf/stubs/strutil.cc
@@ -501,9 +501,11 @@
         if ((!utf8_safe || static_cast<uint8_t>(*src) < 0x80) &&
             (!isprint(*src) ||
              (last_hex_escape && isxdigit(*src)))) {
-          if (dest_len - used < 4) // need space for 4 letter escape
+          // need space for 4 letter escape and the trailing '\0' to
+          // be written by snprintf.
+          if (dest_len - used < 5)
             return -1;
-          sprintf(dest + used, (use_hex ? "\\x%02x" : "\\%03o"),
+          snprintf(dest + used, 5, (use_hex ? "\\x%02x" : "\\%03o"),
                   static_cast<uint8_t>(*src));
           is_hex_escape = use_hex;
           used += 4;