From 5ee8cb3a3fd31e8d445c77e616d8dcb1334fac13 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jes=C3=BAs=20Garc=C3=ADa=20S=C3=A1ez?= <jgarcia@zentyal.com>
Date: Mon, 4 Aug 2014 10:35:04 +0200
Subject: [PATCH] oc-rtf: check valid font name when generating <font> tag

---
 OpenChange/RTFHandler.m | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/OpenChange/RTFHandler.m b/OpenChange/RTFHandler.m
index 5cc619b49..65d5660ca 100644
--- a/OpenChange/RTFHandler.m
+++ b/OpenChange/RTFHandler.m
@@ -824,16 +824,29 @@ const unsigned short ansicpg874[256] = {
               formattingOptions->font_index = font_index;
 
               fontInfo = [fontTable fontInfoAtIndex: font_index];
-              char *v = calloc(128, sizeof(char));
-              if (fontInfo)
+              char *v = NULL;
+              if (fontInfo && fontInfo->name)
                 {
-                  sprintf(v, "<font face=\"%s\">", [fontInfo->name UTF8String]);
+                  if (fontInfo->name.length < 128)
+                    {
+                      int tag_size = 15 + fontInfo->name.length;
+                      v = calloc(tag_size, sizeof(char));
+                      snprintf(v, tag_size, "<font face=\"%s\">", [fontInfo->name UTF8String]);
+                    }
+                  else
+                    {
+                      NSLog(@"RTFHandler: Font %u has %d chars length, parse error? "
+                            "Ignored", font_index, fontInfo->name.length);
+                      v = calloc(7, sizeof(char));
+                      sprintf(v, "<font>");
+                    }
                 }
               else
                 {
                   // RTF badformed? We don't know about that font (font_index).
                   // Anyhow, we still open the html tag because in the future
                   // we will close it (e.g. when new font is used).
+                  v = calloc(7, sizeof(char));
                   sprintf(v, "<font>");
                 }
               [_html appendBytes: v  length: strlen(v)];