From 94130740af1bba0297ef9d29c3fcc44e9bf246da Mon Sep 17 00:00:00 2001
From: Sam Lantinga <slouken@libsdl.org>
Date: Fri, 28 Sep 2018 21:01:43 -0700
Subject: [PATCH] More error checking, and null terminate strings...

---
 IMG_xcf.c | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/IMG_xcf.c b/IMG_xcf.c
index 8b02135d..89f61c08 100644
--- a/IMG_xcf.c
+++ b/IMG_xcf.c
@@ -224,16 +224,17 @@ static char * read_string (SDL_RWops * src) {
   Uint32 tmp;
   char * data;
 
-  tmp = SDL_ReadBE32 (src);
+  tmp = SDL_ReadBE32(src);
   Sint64 remaining = SDL_RWsize(src) - SDL_RWtell(src);
-  if (tmp > 0 && tmp < remaining) {
+  if (tmp > 0 && tmp <= remaining) {
     data = (char *) SDL_malloc (sizeof (char) * tmp);
-    SDL_RWread (src, data, tmp, 1);
-  }
-  else {
+    if (data) {
+      SDL_RWread(src, data, tmp, 1);
+      data[tmp - 1] = '\0';
+    }
+  } else {
     data = NULL;
   }
-
   return data;
 }