lkn
/
pcloudcc-lneely
mirror of https://github.com/lneely/pcloudcc-lneely.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fix pcl-a1j.1: clamp pCnt to PTOOLS_MAX_PARAMS to prevent charBuff stack overflow 

charBuff[30][258] is a fixed-size stack array but pCnt was unbounded,
allowing any caller with params->paramCnt > 30 to overflow the stack
via charBuff[i] access. Add PTOOLS_MAX_PARAMS (30) define, use it to
size charBuff, and clamp pCnt to PTOOLS_MAX_PARAMS with a warning log
before the loop.

Ref GH #195.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Levi Neely 2026-03-07 18:29:33 +01:00
parent bb7fc67a37
commit cda963c4d9
1 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
pclsync/ptools.c
View File

@ -44,12 +44,15 @@
#include <sys/types.h>
#include "papi.h"
#include "pdbg.h"
#include "plibs.h"
#include "pnetlibs.h"
#include "psettings.h"
#include "psql.h"
#include "ptools.h"
#define PTOOLS_MAX_PARAMS 30
char *ptools_get_mac_addr() {
char buffer[128];
@ -93,10 +96,16 @@ int ptools_create_backend_event(const char *binapi, const char *category,
binparam *paramsLocal;
int i;
int pCnt = params->paramCnt; // Number of optional parameters
if (pCnt > PTOOLS_MAX_PARAMS) {
pdbg_logf(D_WARNING,
"ptools_create_backend_event: paramCnt %d exceeds max %d, clamping",
pCnt, PTOOLS_MAX_PARAMS);
pCnt = PTOOLS_MAX_PARAMS;
}
int mpCnt = 6; // Number of mandatory params
int tpCnt; // Total number of parameters
char *keyParams = NULL;
char charBuff[30][258];
char charBuff[PTOOLS_MAX_PARAMS][258];
sock = papi_connect(binapi, psync_setting_get_bool(0));