Skip to content

Commit 6121aa8

Browse files
authored
TOOLS-3050 Fix stack corruption happening due to buffer overflow.
1 parent 95f4878 commit 6121aa8

File tree

1 file changed

+19
-5
lines changed

1 file changed

+19
-5
lines changed

src/utils.c

Lines changed: 19 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -357,15 +357,29 @@ str_vector_tostring(const as_vector* v)
357357

358358
if (v->size == 0) {
359359
buf[0] = '\0';
360+
return buf;
360361
}
361362

363+
char* dots = "...";
364+
uint32_t needed = 0;
365+
362366
for (uint32_t i = 0; i < v->size; i++) {
363-
pos += (uint64_t) snprintf(buf + pos, sizeof(buf) - pos, "%s",
364-
(const char*) as_vector_get((as_vector*) v, i));
365-
if (i < v->size - 1) {
366-
pos += (uint64_t) snprintf(buf + pos, sizeof(buf) - pos, ",");
367+
const char* str = (const char*) as_vector_get((as_vector*) v, i);
368+
369+
// Add the set-name only if there is space for the dots after it.
370+
needed = (uint32_t)strlen(str) + 1 + 3; // 1 for comma, 3 for dots
371+
372+
if (pos + needed > 1024) {
373+
// Space for the dots was reserved in the previous iteration.
374+
pos += (uint64_t) sprintf(buf + pos, "%s", dots);
375+
return buf;
367376
}
377+
378+
pos += (uint64_t) sprintf(buf + pos, "%s,", str);
368379
}
380+
381+
buf[pos - 1] = '\0'; // remove the trailing comma
382+
369383
return buf;
370384
}
371385

@@ -2282,4 +2296,4 @@ read_private_key(char* pkey_data,
22822296
return -1;
22832297
}
22842298
return 0;
2285-
}
2299+
}

0 commit comments

Comments
 (0)