Crash on tooltip hovering: snprintf buffer overflow fix

[caco3]

The gen_tooltip function now properly tracks the remaining buffer space:

• Added bounds checking with if(r > 0 && r < l)
• Decrements remaining buffer size l -= r when advancing pointer p
• Prevents writing past the end of the tooltip_msg buffer

This should resolve the GUI crash when hovering over the graph.

[jmtd]

What values meet this criteria?

[caco3]

The condition guards against two distinct snprintf failure/edge cases:

• r > 0 — snprintf returns a negative value on encoding errors, and 0 if nothing was written. Advancing p or decrementing l in those cases would be wrong.

• r < l — snprintf returns the number of characters it would have written if the buffer were large enough, regardless of truncation. So if r >= l, the output was truncated: only l-1 bytes were actually written, but r is larger than l. Advancing p by r would jump past the end of the buffer.

The combined check r > 0 && r < l means: "snprintf succeeded and the output fit entirely in the remaining buffer" — only then is it safe to advance p by exactly r and subtract r from l.

One subtle implication: if truncation occurs (i.e., r >= l), the pointer p and size l are not updated, so subsequent writes still start at the same (now null-terminated) position. This effectively silently drops the truncated content rather than writing garbage or crashing.

[jmtd]

But an int can’t be both >0 and <1

[caco3]

r < l

It is not a number, its the letter L!

And don't complain about this, it was not me who introduced the l variable 😄

[jmtd]

So it is! Sorry for the noise

[caco3]

No problem!
It is better to be to too cautious than introducing new bugs.

[l8gravely]

>>>> "CaCO3" == CaCO3 ***@***.***> writes: @caco3 commented on this pull request. -------------------------------------------------------------------------------------------------- In src/libduc-graph/graph.c: > @@ -208,9 +208,13 @@ static void gen_tooltip(duc_graph *g, struct duc_size *size, const char *name, d char *p = g->tooltip_msg; int l = sizeof(g->tooltip_msg); if(name) { - p += snprintf(p, l, "name: %s\n", name); + int r = snprintf(p, l, "name: %s\n", name); + if(r > 0 && r < l) { r < l It is not a number, its the letter L! And don't complain about this, it was not me who introduced the l variable 😄

So I'd re-work this to use 'len' instead of 'l' in this patch. I'll look this over more tomorrow. Still stuffed from Sunday Easter dinner.