From 18dde7b26c2b8a8aa5ed99b0fa26aafaf11d4c95 Mon Sep 17 00:00:00 2001
From: Kovid Goyal <kovid@kovidgoyal.net>
Date: Fri, 3 Nov 2017 10:01:52 +0530
Subject: [PATCH] ...

---
 kitty/parser.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/kitty/parser.c b/kitty/parser.c
index 0f16d4f66..4b4c2ac0d 100644
--- a/kitty/parser.c
+++ b/kitty/parser.c
@@ -79,7 +79,9 @@ _report_params(PyObject *dump_callback, const char *name, unsigned int *params,
     static char buf[MAX_PARAMS*3] = {0};
     unsigned int i, p;
     for(i = 0, p=0; i < count && p < MAX_PARAMS*3-20; i++) {
-        p += snprintf(buf + p, MAX_PARAMS*3 - p, "%u ", params[i]);
+        int n = snprintf(buf + p, MAX_PARAMS*3 - p, "%u ", params[i]);
+        if (n < 0) break;
+        p += n;
     }
     buf[p] = 0;
     Py_XDECREF(PyObject_CallFunction(dump_callback, "ss", name, buf)); PyErr_Clear();
@@ -370,7 +372,7 @@ repr_csi_params(unsigned int *params, unsigned int num_params) {
     if (!num_params) return "";
     static char buf[256];
     int pos = 0;
-    while (pos < 200 && num_params) {
+    while (pos < 200 && num_params && sizeof(buf) > pos + 1) {
         const char *fmt = num_params > 1 ? "%u " : "%u";
         int ret = snprintf(buf + pos, sizeof(buf) - pos - 1, fmt, params[num_params--]);
         if (ret < 0) return "An error occurred formatting the params array";