ArduPilot / ArduPilot/ardupilot

DataFlash LogStructure can have its fields not null terminated

Open
#5,863 10 comments 0 reactions 1 assignee Claimed by @peterbarker View on GitHub
BUG Logging
Dominant language
C++
Stars
15.9k
Forks
21.4k
Avg merge
3d 17h
Merged PRs (30d)
119

Description

Found by Coverity Scan (CID 126737)

In https://github.com/ArduPilot/ardupilot/blob/2c8a0a912310bb03ffc2af5a1e69f09e9f7feb39/libraries/DataFlash/DataFlash.cpp#L402-L404 there's the possibility that strings in the *log_write_fmt* struct will have sizes bigger than their destinations allow.

In my opinion these 3 lines should be changed to:

```
strncpy((char*)logstruct.name, f->name, sizeof(logstruct.name) - 1);
strncpy((char*)logstruct.format, f->fmt, sizeof(logstruct.format) - 1);
strncpy((char*)logstruct.labels, f->labels, sizeof(logstruct.labels) - 1);
logstruct.name[4] = '\0';
logstruct.format[15] = '\0';
logstruct.labels[63] = '\0'; // these will need to be memset if we want to keep const
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.