Replace Unsafe C String Function
- Dominant language
- Go
- Stars
- 2
- Forks
- 4
- PR merge metrics
- No merged PRs in 30d
Description
The function `append` in `sniffer.c` uses the unsafe `vsprintf`, which can lead to buffer overflows if a large or malformed packet is processed.
**Task:**
* [ ] Replace `vsprintf` with the safer `vsnprintf` alternative, making sure to use the buffer's available space as the limit.
**Suggested code change**
```c
va_list ap;
va_start(ap, fmt);
vsnprintf(*dst + used, *cap - used, fmt, ap);
va_end(ap);
```
**Why:**
Using `vsnprintf` helps prevent buffer overflows and potential crashes or vulnerabilities.
**Reference:**
See [[CWE-242: Use of Inherently Dangerous Function](https://cwe.mitre.org/data/definitions/242.html)](https://cwe.mitre.org/data/definitions/242.html)
Contributor guide
Assessment
This issue has not been assessed yet.