Repository navigation
Conversation
…JSON The modes and transmitter JSON files were read into a buffer of exactly the file size with no terminating NUL. nx_json_parse() takes no length, so a truncated download could make it read, and in some cases write, past the end of the buffer. Allocate one extra zeroed byte. nx_json_get() returns a node with a NULL text_value when a key is missing, which was passed straight to strncpy(). Skip mode entries without a name and transmitter entries without a description. Fixes csete#434
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #434.
trsp_update_files()readmodes.jsonand the transmitters file into a buffer of exactly the file size, with no NUL at the end.nx_json_parse()takes no length, so a file cut off inside a string, number or keyword made it read past the buffer, and with a trailing quote or backslash it also wrote past it. Both buffers now get one extra zeroed byte.nx_json_get()returns a node with a NULLtext_valuewhen the key is missing, and that went straight intostrncpy(). A mode withoutnameor a transmitter withoutdescriptionnow gets skipped instead of crashing.Tested with a small harness that calls
trsp_update_files()built with AddressSanitizer, against master and this branch:.trspfilemodes.jsontruncated inside a string: master reports a heap-buffer-overflow, branch parses finename: master segfaults instrncpy, branch skips itdescription: master segfaults, branch skips itThe normal build (
-Wall -Wextra -pedantic) has no new warnings.