Skip to content

fixing a possible write beyond the array boundary. - #1028

Open
ihsinme wants to merge 1 commit into
htacg:nextfrom
ihsinme:patch-1
Open

fixing a possible write beyond the array boundary.#1028
ihsinme wants to merge 1 commit into
htacg:nextfrom
ihsinme:patch-1

Conversation

@ihsinme

@ihsinme ihsinme commented Mar 9, 2022

Copy link
Copy Markdown
Contributor

If you don't initialize array buf and use strlen to determine the zero length, there is a possibility that the value of function memset will go beyond array buf. This will happen if there are no zeros in the declared array.

If you don't initialize array `buf` and use `strlen` to determine the zero length, there is a possibility that the value of function `memset` will go beyond array `buf`. This will happen if there are no zeros in the declared array.
@ihsinme

ihsinme commented Apr 5, 2022

Copy link
Copy Markdown
Contributor Author

good afternoon.
any news on this PR?

@zopsicle

Copy link
Copy Markdown

On line 262 it also calls strcpy(buf,rep); with seemingly no bounds check? If rep is larger than 1024 then it’ll overflow the buffer. Not an immediate problem as strrep is currently only called with constants and localized messages, but if it ever ends up being called with user input this is catastrophic.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants