lkn
/
pcloudcc-lneely
mirror of https://github.com/lneely/pcloudcc-lneely.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fix pcl-a1j.1: replace sprintf with snprintf and add strcat length check in ptools_create_backend_event() 

Add paramname length check (> 254 bytes → skip with warning) before
snprintf into charBuff[i][258], and validate the snprintf return
value. Add explicit length check before strcat into keyParams to
prevent overflow when paramname exceeds remaining buffer space.
Eliminates buffer overflow from long paramname.

Ref GH #195.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Levi Neely 2026-03-07 18:26:37 +01:00
parent d5a1c74c43
commit bb7fc67a37
1 changed files with 32 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
pclsync/ptools.c
View File

@ -130,8 +130,31 @@ int ptools_create_backend_event(const char *binapi, const char *category,
keyParams[0] = 0; keyParams[0] = 0;
for (i = 0; i < pCnt; i++) { for (i = 0; i < pCnt; i++) {
size_t namelen;
size_t used;
size_t needed;
int n;
charBuff[i][0] = 0; charBuff[i][0] = 0;
/* Reject paramnames > 254 bytes: "key" (3) + paramname + NUL must fit in 258 */
namelen = strlen(params->Params[i].paramname);
if (namelen > 254) {
pdbg_logf(D_WARNING,
"ptools_create_backend_event: paramname[%d] too long (%zu bytes), skipping",
i, namelen);
continue;
}
/* Length check before strcat: verify paramname fits in remaining keyParams space */
used = strlen(keyParams);
needed = namelen + (i > 0 ? 2 : 1); /* comma (if i>0) + name + NUL */
if (used + needed > (size_t)(258 * pCnt)) {
pdbg_logf(D_WARNING,
"ptools_create_backend_event: keyParams buffer full, skipping param %d",
i);
continue;
}
if (i > 0) { if (i > 0) {
strcat(keyParams, ","); strcat(keyParams, ",");
strcat(keyParams, params->Params[i].paramname); strcat(keyParams, params->Params[i].paramname);
@ -139,7 +162,15 @@ int ptools_create_backend_event(const char *binapi, const char *category,
strcat(keyParams, params->Params[i].paramname); strcat(keyParams, params->Params[i].paramname);
} }
snprintf(charBuff[i], sizeof(charBuff[i]), "key%s", params->Params[i].paramname); n = snprintf(charBuff[i], sizeof(charBuff[i]), "key%s", params->Params[i].paramname);
if (n < 0 || n >= (int)sizeof(charBuff[i])) {
/* Should not happen after the namelen > 254 check above, but guard anyway */
pdbg_logf(D_WARNING,
"ptools_create_backend_event: snprintf truncated charBuff[%d], skipping",
i);
charBuff[i][0] = 0;
continue;
}
if (params->Params[i].paramtype == 0) { if (params->Params[i].paramtype == 0) {
paramsLocal[mpCnt + i] = paramsLocal[mpCnt + i] =