strutils: fix buffer overflow in formatBiggestFloat #1423
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Previously, strutils.formatBiggestFloat was implemented using sprintf and as such come with a risk of buffer overflow. This was observed via tests within disruptek/insideout. Switch the implementation to snprintf and remove the temporary buffer used. This solves the overflow and shave ~2 KiB from the stack size requirement for this procedure. Additionally, extra error checking code is added for potential failures of snprintf.
saem
approved these changes
Aug 19, 2024
It's too implementation specific and won't be of any help if we move to a native impl at one point. |
|
/merge (updated the PR body slightly) |
|
Merge requested by: @saem Contents after the first section break of the PR description has been removed and preserved below:
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
Fixed a potential buffer overflow in
struts.formatBiggestFloat.Details
Previously,
strutils.formatBiggestFloatwas implemented usingsprintfand as such came with a risk of buffer overflow. This wasobserved via tests in disruptek/insideout.
sprintfwithsnprintf.the target buffer.
snprintf.