Merge pull request matplotlib#4086 from tacaswell/cve_patch

BUG : fix security bug reported via debian by Matt Giuca

Author: mdboom

.travis.yml

@@ -21,7 +21,7 @@ matrix:
       env: BUILD_DOCS=true
 
 install:
-  - pip install -q --use-mirrors nose python-dateutil numpy pep8 pyparsing pillow
+  - pip install -q --use-mirrors nose python-dateutil numpy pep8==1.5.7 pyparsing pillow
   - sudo apt-get update && sudo apt-get -qq install inkscape libav-tools mencoder
   # We use --no-install-recommends to avoid pulling in additional large latex docs that we don't need
   - if [[ $BUILD_DOCS == true ]]; then sudo apt-get install -qq --no-install-recommends dvipng texlive-latex-base texlive-latex-extra texlive-fonts-recommended graphviz; fi

src/mplutils.cpp

@@ -18,7 +18,10 @@ Printf::Printf(const char *fmt, ...)
 {
     va_list ap;
     va_start(ap, fmt);
-    vsprintf(buffer, fmt, ap);
+    vsnprintf(buffer, 1024, fmt, ap);
+    // Null-terminate the string. Non-standard C implementations (e.g.,
+    // Microsoft Visual C++) do not do this automatically.
+    buffer[1023] = '\0';
     va_end(ap);  // look ma - I rememberd it this time
 }