Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

"sprintf" function being used in googletest.h which is not secure #536

Closed
chaira19 opened this issue Mar 26, 2020 · 3 comments
Closed

"sprintf" function being used in googletest.h which is not secure #536

chaira19 opened this issue Mar 26, 2020 · 3 comments
Labels
enhancement

Comments

@chaira19
Copy link

chaira19 commented Mar 26, 2020 •
edited
Loading

The sprintf function, when used with certain format specifiers, poses two types of security risk: (1) writing memory it shouldn't; (2) reading memory it shouldn't. If snprintf is used with a size parameter that matches the buffer, it won't write anything it shouldn't.
@sergiud
Copy link
Collaborator

sergiud commented Mar 26, 2020

What issue is this causing?

@chaira19
Copy link
Author

@sergiud I have updated the description. sprintf function reads and write memory beyond that it shouldn't and therefore has security problems. It is banned in many organizations including mine.

aesophor added a commit to aesophor/glog that referenced this issue May 8, 2020
@aesophor
Replace sprintf() with snprintf() (google#536)
2e87f98 
sprintf poses two security risks:
(1) write to memory where it shouldn't
(2) read from memory where it shouldn't

This commit replaces the use of sprintf() with snprintf()
which has a size parameter to ensure the problems mentioned
above won't take place.
sergiud added a commit that referenced this issue Sep 29, 2020
@sergiud
Merge pull request #551 from aesophor/replace-sprintf
4c5a60c 
Replace sprintf() with snprintf() (#536)
@sergiud
Copy link
Collaborator

sergiud commented Sep 30, 2020

Fixed in #551.

@sergiud sergiud closed this as completed Sep 30, 2020
@sergiud sergiud mentioned this issue May 6, 2021
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
enhancement
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@sergiud @chaira19