Security: risk of buffer overflow in submit_upstream_work

[pascal-cuoq]

In submit_upstream_work, line 452 :

        sprintf(s,
            "{\"method\": \"mining.submit\", \"params\": [\"%s\", \"%s\", \"%s\", \"%s\", \"%s\"], \"id\":4}",
            pool->user, work->job_id, xnonce2str, ntimestr, noncestr);

The variable s indicates a stack-allocated buffer of a fixed size. Also work->job_id, one of the dangerous-looking arguments, comes straight from the server and I did not see anything that would limit its size (*).

The other dangerous-looking argument is xnonce2str, which has a dynamic size in work->xnonce2_len.

This was fixed in pooler-cpuminer with the following commit. The vulnerability appears to have first been reported here.