From cda963c4d9db91dd54f127eb8e4555d882cb7dde Mon Sep 17 00:00:00 2001 From: Levi Neely Date: Sat, 7 Mar 2026 18:29:33 +0100 Subject: [PATCH] Fix pcl-a1j.1: clamp pCnt to PTOOLS_MAX_PARAMS to prevent charBuff stack overflow charBuff[30][258] is a fixed-size stack array but pCnt was unbounded, allowing any caller with params->paramCnt > 30 to overflow the stack via charBuff[i] access. Add PTOOLS_MAX_PARAMS (30) define, use it to size charBuff, and clamp pCnt to PTOOLS_MAX_PARAMS with a warning log before the loop. Ref GH #195. Co-Authored-By: Claude Sonnet 4.6 --- pclsync/ptools.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/pclsync/ptools.c b/pclsync/ptools.c index 356a5c5..947ef62 100644 --- a/pclsync/ptools.c +++ b/pclsync/ptools.c @@ -44,12 +44,15 @@ #include #include "papi.h" +#include "pdbg.h" #include "plibs.h" #include "pnetlibs.h" #include "psettings.h" #include "psql.h" #include "ptools.h" +#define PTOOLS_MAX_PARAMS 30 + char *ptools_get_mac_addr() { char buffer[128]; @@ -93,10 +96,16 @@ int ptools_create_backend_event(const char *binapi, const char *category, binparam *paramsLocal; int i; int pCnt = params->paramCnt; // Number of optional parameters + if (pCnt > PTOOLS_MAX_PARAMS) { + pdbg_logf(D_WARNING, + "ptools_create_backend_event: paramCnt %d exceeds max %d, clamping", + pCnt, PTOOLS_MAX_PARAMS); + pCnt = PTOOLS_MAX_PARAMS; + } int mpCnt = 6; // Number of mandatory params int tpCnt; // Total number of parameters char *keyParams = NULL; - char charBuff[30][258]; + char charBuff[PTOOLS_MAX_PARAMS][258]; sock = papi_connect(binapi, psync_setting_get_bool(0));