Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

sprintf/snprintf format string overflow warnings #165

Closed
cranderson opened this issue Feb 2, 2020 · 0 comments · Fixed by #168
Closed

sprintf/snprintf format string overflow warnings #165

cranderson opened this issue Feb 2, 2020 · 0 comments · Fixed by #168

Comments

@cranderson
Copy link
Contributor

When compiling on Fedora 31:

gcc -DHAVE_CONFIG_H -I. -I.. -Wall -Wextra -Wno-sign-compare -DIPV6 -O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -c -o fping-fping.o test -f 'fping.c' || echo './'fping.c
make[2]: Leaving directory '/builddir/build/BUILD/fping-4.2/src'
fping.c: In function 'sprint_tm':
fping.c:2599:28: warning: '__builtin___sprintf_chk' may write a terminating nul past the end of the destination [-Wformat-overflow=]
2599 | sprintf(buf, "%d.%d", t / 100, (t % 100) / 10);
| ^
In file included from /usr/include/stdio.h:867,
from fping.c:44:
/usr/include/bits/stdio2.h:36:10: note: '__builtin___sprintf_chk' output between 4 and 11 bytes into a destination of size 10
36 | return __builtin___sprintf_chk (__s, __USE_FORTIFY_LEVEL - 1,
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
37 | __bos (__s), __fmt, __va_arg_pack ());
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
fping.c:2595:26: warning: '%02d' directive writing 2 bytes into a region of size between 1 and 8 [-Wformat-overflow=]
2595 | sprintf(buf, "%d.%02d", t / 100, t % 100);
| ^~~~
fping.c:2595:22: note: directive argument in the range [0, 99]
2595 | sprintf(buf, "%d.%02d", t / 100, t % 100);
| ^~~~~~~~~
In file included from /usr/include/stdio.h:867,
from fping.c:44:
/usr/include/bits/stdio2.h:36:10: note: '__builtin___sprintf_chk' output between 5 and 12 bytes into a destination of size 10
36 | return __builtin___sprintf_chk (__s, __USE_FORTIFY_LEVEL - 1,
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
37 | __bos (__s), __fmt, __va_arg_pack ());
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
fping.c: In function 'add_name':
fping.c:2340:82: warning: ')' directive output may be truncated writing 1 byte into a region of size between 0 and 510 [-Wformat-truncation=]
2340 | snprintf(nameaddrbuf, sizeof(nameaddrbuf) / sizeof(char), "%s (%s)", printname, addrbuf);
| ^
In file included from /usr/include/stdio.h:867,
from fping.c:44:
/usr/include/bits/stdio2.h:67:10: note: '__builtin___snprintf_chk' output between 4 and 514 bytes into a destination of size 512
67 | return __builtin___snprintf_chk (__s, __n, __USE_FORTIFY_LEVEL - 1,
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
68 | __bos (__s), __fmt, __va_arg_pack ());
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant