Skip to content

Fix buffer overflows#140

Open
jserv wants to merge 1 commit intotaviso:mainfrom
jserv:fix-buffer
Open

Fix buffer overflows#140
jserv wants to merge 1 commit intotaviso:mainfrom
jserv:fix-buffer

Conversation

@jserv
Copy link
Contributor

@jserv jserv commented Feb 20, 2026

  • display.c: stpstatus[64] overflow via strcat chain; enlarged to 256, replaced with bounded snprintf
  • main.c: lotargv alloca undercount; first-pass counted 1 per option but pass-through options with args need 2 slots; count += 2 per iteration
  • showme.c: clear_showme writes past MAX_SHOWME arrays; add count guard
  • coffsyrup.c: Relocation boundary check allows 4-byte write past section buffer; account for sizeof(uint32_t) in range check Symbol index off-by-one; change > to >= for f_nsyms bound

- display.c: stpstatus[64] overflow via strcat chain; enlarged to 256,
  replaced with bounded snprintf
- main.c: lotargv alloca undercount; first-pass counted 1 per option but
  pass-through options with args need 2 slots; count += 2 per iteration
- showme.c: clear_showme writes past MAX_SHOWME arrays; add count guard
- coffsyrup.c:
  Relocation boundary check allows 4-byte write past section
  buffer; account for sizeof(uint32_t) in range check
  Symbol index off-by-one; change > to >= for f_nsyms bound
@taviso
Copy link
Owner

taviso commented Feb 21, 2026

Hmm, I think you're right about the argument parsing - nice catch!

The stpstatus patch doesn't look correct, I think it's uninitialized when the first strcat() happens, so you can't strlen it? Maybe you misread it and thought it was strcpy?

@taviso
Copy link
Owner

taviso commented Feb 21, 2026

No, I'm wrong - I think it is always initialized, hmm - oops, maybe you're right.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants