Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

String overflows #686

Open
averater opened this issue Oct 14, 2024 · 3 comments
Open

String overflows #686

averater opened this issue Oct 14, 2024 · 3 comments

Comments

@averater
Copy link
Contributor

There are multiple possible string overflow issues. One recent commit tried to solve two cases but used the wrong length: 0d76220

On my compiler I get this warning: stringop-overflow.

This should be solved by either double-checking all strcpy and strncpy so the buffer definitely have enough space for the trivial cases with known lengths or by checks of available buffer for the non-trivial cases

Here is some code to explain the issues:

#include <string.h> 
#include <stdio.h>
#include <stdlib.h>

int avail(char buf[], int l) {
    int ret = l - strlen(buf) - 1;
    if (ret<0) return 0;
    return ret;
}
int main(void) 
{
    {
        char str1[4] = "abc";
        char str2[5] = "def";
        strcat(str1, str2);
        strcat(str1, "...");
        puts(str1);  // Buffer overflow!
    }{
        char str1[4] = "abc";
        char str2[5] = "def";
        strncat(str1, str2, strlen(str2));
        strncat(str1, "...", 3);
        puts(str1);  // Buffer overflow!
    }{
        char str1[8] = "abc";
        int l = sizeof(str1)/sizeof(*str1);
        char str2[3] = "def";  // not null terminated
        strncat(str1, str2, avail(str1, l));
        strncat(str1, "...", avail(str1, l));
        puts(str1);  // Undefined
    }{
        char str1[8] = "abc";
        int l = sizeof(str1)/sizeof(*str1);
        char str2[4] = "def";
        strncat(str1, str2, avail(str1, l));
        strncat(str1, "...", avail(str1, l));
        puts(str1);  // OK
    }
}
@COVESA COVESA deleted a comment from averater Oct 18, 2024
@michael-methner
Copy link
Collaborator

Hello @averater ,
thanks for the fix but please do not upload binary (zip files) files here. I just deleted it. Can you please open a pull request?

@averater
Copy link
Contributor Author

dlt-daemon.diff.txt
There are a lot of places where this should be fixed to stop the warnings. Most are of the trivial kind where I just replaced strncat with strcat. But since it is fairly large I'd prefer to not drive a pull request. I uploaded as a txt file instead.

@averater
Copy link
Contributor Author

Got time after my other issues were done so here are two pull requests:
#697
#696

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants