The RedHat CVE-2014-8184 patch did not fix the potential buffer overruns
and missing trailing \0 from the strncpy call.
---
 liblouis/compileTranslationTable.c |    4 ++++
 1 file changed, 4 insertions(+)

--- a/liblouis/compileTranslationTable.c
+++ b/liblouis/compileTranslationTable.c
@@ -4534,6 +4534,8 @@ findTable (const char *tableName)
 	int listLength;
 	int currentListPos = 0;
 	listLength = strlen (pathList);
+	if (listLength >= MAXSTRING)
+	  listLength = MAXSTRING-1;
 	for (k = 0; k < listLength; k++)
 	  if (pathList[k] == ',')
 	    break;
@@ -4547,6 +4549,7 @@ findTable (const char *tableName)
 	  {			/* Compile a list of files */
 	    char path[MAXSTRING];
 	    strncpy (path, pathList, k);
+	    path[k] = 0;
 	    snprintf (trialPath, MAXSTRING-1, "%s%s%s", path, pathEnd, tableName);
 	    currentListPos = k + 1;
 	    if ((tableFile = fopen (trialPath, "rb")))
@@ -4557,6 +4560,7 @@ findTable (const char *tableName)
 		  if (pathList[k] == ',')
 		    break;
 		strncpy (path, &pathList[currentListPos], k - currentListPos);
+		path[k - currentListPos] = 0;
 		snprintf (trialPath, MAXSTRING-1, "%s%s%s", path, pathEnd, tableName);
 		if ((tableFile = fopen (trialPath, "rb")))
 		  currentListPos = k + 1;
