Fix parsing bug in cgiCheckVariables.

diff --git a/cgi-bin/var.c b/cgi-bin/var.c
index e5443499d5e46b5cf490f8adc652c6ffbefb6120..f251aa173a12b979d858c0421adfdd7d21c9db06 100644 (file)
--- a/cgi-bin/var.c
+++ b/cgi-bin/var.c
@@ -1,7 +1,7 @@
 /*
  * CGI form variable and array functions for CUPS.
  *
- * Copyright © 2020-2025 by OpenPrinting.
+ * Copyright © 2020-2026 by OpenPrinting.
  * Copyright © 2007-2019 by Apple Inc.
  * Copyright © 1997-2005 by Easy Software Products.
  *
@@ -88,8 +88,11 @@ cgiCheckVariables(const char *names) /* I - Variables to look for */
     while (*names == ' ' || *names == ',')
       names ++;
 
-    for (s = name; *names != '\0' && *names != ' ' && *names != ','; s ++, names ++)
-      *s = *names;
+    for (s = name; *names != '\0' && *names != ' ' && *names != ','; names ++)
+    {
+      if (s < (name + sizeof(name) - 1))
+        *s++ = *names;
+    }
 
     *s = 0;
     if (name[0] == '\0')