Ubuntu: https://bugs.launchpad.net/ubuntu/+source/x11-xkb-utils/+bug/309013
Upstream: https://bugs.freedesktop.org/show_bug.cgi?id=19490
Description: static buffer gets overflowed when running "xkbcomp -C :0"
Index: libxkbfile-1.0.5/src/cout.c
===================================================================
--- libxkbfile-1.0.5.orig/src/cout.c	2009-01-09 17:14:42.000000000 -0800
+++ libxkbfile-1.0.5/src/cout.c	2009-01-09 17:21:48.000000000 -0800
@@ -132,13 +132,16 @@
 register unsigned 	i,n;
 XkbKeyTypePtr		type;
 Atom *			names;
-char			prefix[32];
+char *			prefix = NULL;
 
     fprintf(file,"\n\nstatic void\n");
     fprintf(file,"initTypeNames(DPYTYPE dpy)\n");
     fprintf(file,"{\n");
     for (i=0,type=xkb->map->types;i<xkb->map->num_types;i++,type++) {
-	strcpy(prefix,XkbAtomText(dpy,type->name,XkbCFile));
+	if (asprintf(&prefix, "%s", XkbAtomText(dpy,type->name,XkbCFile))<0) {
+		perror("asprintf");
+		exit(1);
+	}
 	if (type->name!=None)
 	    fprintf(file,"    dflt_types[%d].name= GET_ATOM(dpy,\"%s\");\n",i,
 					XkbAtomText(dpy,type->name,XkbCFile));
@@ -155,6 +158,8 @@
 		fprintf(file,"GET_ATOM(dpy,\"%s\");\n",tmp);
 	    }
 	}
+	free(prefix);
+	prefix = NULL;
     }
     fprintf(file,"}\n");
     return;
@@ -166,7 +171,7 @@
 register unsigned	i,n;
 XkbClientMapPtr		map;
 XkbKeyTypePtr		type;
-char 			prefix[32];
+char * 			prefix = NULL;
 
     if ((!xkb)||(!xkb->map)||(!xkb->map->types)) {
 	_XkbLibError(_XkbErrMissingTypes,"WriteCHdrKeyTypes",0);
@@ -182,7 +187,10 @@
 				XkbAtomText(dpy,xkb->names->types,XkbCFile));
     }
     for (i=0,type=map->types;i<map->num_types;i++,type++) {
-	strcpy(prefix,XkbAtomText(dpy,type->name,XkbCFile));
+	if (asprintf(&prefix, "%s", XkbAtomText(dpy,type->name,XkbCFile))<0) {
+		perror("asprintf");
+		exit(1);
+	}
 
 	if (type->map_count>0) {
 	    XkbKTMapEntryPtr	entry;
@@ -209,10 +217,15 @@
 							 type->num_levels);
 	}
 	fprintf(file,"\n");
+	free(prefix);
+	prefix = NULL;
     }
     fprintf(file,"static XkbKeyTypeRec dflt_types[]= {\n");
     for (i=0,type=map->types;i<(unsigned)map->num_types;i++,type++) {
-	strcpy(prefix,XkbAtomText(dpy,type->name,XkbCFile));
+	if (asprintf(&prefix, "%s", XkbAtomText(dpy,type->name,XkbCFile))<0) {
+		perror("asprintf");
+		exit(1);
+	}
 	if (i!=0)	fprintf(file,",\n");
 	fprintf(file,"    {\n	{ %15s, %15s, %15s },\n",
 			XkbModMaskText(type->mods.mask,XkbCFile),
@@ -229,6 +242,8 @@
 	if (type->level_names!=NULL)
 	     fprintf(file,"	None,	lnames_%s\n    }",prefix);
 	else fprintf(file,"	None,	NULL\n    }");
+	free(prefix);
+	prefix = NULL;
     }
     fprintf(file,"\n};\n");
     fprintf(file,"#define num_dflt_types (sizeof(dflt_types)/sizeof(XkbKeyTypeRec))\n");