Repository navigation
Conversation
AppControl::Init copied the decoder script directory into a 256-byte stack buffer with strcpy, which overflows when the application sits in a deeply nested folder. Pass the UTF-8 bytes straight to srd_init. ds_set_firmware_resource_dir and ds_set_user_data_dir strcpy into fixed global buffers. Refuse a path that does not fit and log it, instead of overflowing. The demo driver copied the user-data path into 500-byte stack buffers and appended "/demo/<mode>/<pattern>.demo", which overflowed for any user-data path close to the limit; pattern names longer than 49 bytes overflowed a fixed short_name buffer. Build these strings on the heap. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01S6AB69CNtvrecQVn1nyvL1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Three fixed-size path copies can overflow:
AppControl::Initcopied the decoder script directory into a 256-byte stack buffer withstrcpy, which overflows when the application sits in a deeply nested folder. The path is now passed tosrd_initas UTF-8 directly.ds_set_firmware_resource_dirandds_set_user_data_dirstrcpyinto 500-byte global buffers. A path that does not fit is now refused and logged./demo/<mode>/<pattern>.demo, which overflowed for any user-data path near the limit; pattern names longer than 49 bytes also overflowed a fixedshort_namebuffer. These strings are now built on the heap.Checked with AddressSanitizer: before the change, a 499-byte user-data path overflowed
dir_path_bufinget_pattern_mode_from_file; after it, the same path builds the full 517-byte demo path without error.🤖 Generated with Claude Code
https://claude.ai/code/session_01S6AB69CNtvrecQVn1nyvL1