COVESA / COVESA/dlt-daemon

String overflows

Open
#686 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
459
Forks
340
Avg merge
4d 21h
Merged PRs (30d)
2

Description

There are multiple possible string overflow issues. One recent commit tried to solve two cases but used the wrong length: https://github.com/COVESA/dlt-daemon/commit/0d76220d78e0dd2e1139058e2e96e35e8a72c753

On my compiler I get this warning: stringop-overflow.

This should be solved by either double-checking all strcpy and strncpy so the buffer definitely have enough space for the trivial cases with known lengths or by checks of available buffer for the non-trivial cases

Here is some code to explain the issues:
```
#include
#include
#include

int avail(char buf[], int l) {
int ret = l - strlen(buf) - 1;
if (ret<0) return 0;
return ret;
}
int main(void)
{
{
char str1[4] = "abc";
char str2[5] = "def";
strcat(str1, str2);
strcat(str1, "...");
puts(str1); // Buffer overflow!
}{
char str1[4] = "abc";
char str2[5] = "def";
strncat(str1, str2, strlen(str2));
strncat(str1, "...", 3);
puts(str1); // Buffer overflow!
}{
char str1[8] = "abc";
int l = sizeof(str1)/sizeof(*str1);
char str2[3] = "def"; // not null terminated
strncat(str1, str2, avail(str1, l));
strncat(str1, "...", avail(str1, l));
puts(str1); // Undefined
}{
char str1[8] = "abc";
int l = sizeof(str1)/sizeof(*str1);
char str2[4] = "def";
strncat(str1, str2, avail(str1, l));
strncat(str1, "...", avail(str1, l));
puts(str1); // OK
}
}
```

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.