bugSimulavr: an AVR simulator - Bugs: bug #29049, wrong use of strncat()


bug #29049: wrong use of strncat()

Submitted by:  Ilya Barygin <conscious>
Submitted on:  Wed Mar 3 11:52:10 2010  
Category: NoneSeverity: 3 - Normal
Item Group: NoneStatus: Fixed
Privacy: PublicAssigned to: None
Open/Closed: ClosedComponent Version: simulavr

Add a New Comment (Rich MarkupRich Markup):

You are not logged in

Please log in, so followups can be emailed to you.


Mon Oct 6 17:05:16 2014, comment #2:


because now all occurrences are eliminated, the problem is too eliminated. :-) Closed!

cu, Thomas

Thomas K. <tomk>
Project Administrator
Wed Mar 3 13:37:51 2010, comment #1:


Thank you for the report. Your patch should indeed fix the problem (I have not tested it, though).

Accidentally, Juergen Weigert reported the same problem and also provided a patch, see http://savannah.nongnu.org/patch/?7078

Some commiter should apply one of these patches. (I recommend the patch 7078 since it works even buf[80] is resized.) And probably do a release, too. Otherwise we might see more duplicated effort.

Petr Hluzin <petrh>
Project Member
Wed Mar 3 11:52:10 2010, original submission:

A rebuild of simulavr for Ubuntu Lucid detected a possible buffer overflow:

if i486-linux-gnu-gcc -DHAVE_CONFIG_H -I. -I. -I. -Wall -Winline -Werror -I../src/getopt -Wall -g -O2 -MT eeprom.o -MD -MP -MF ".deps/eeprom.Tpo" -c -o eeprom.o eeprom.c; \
then mv -f ".deps/eeprom.Tpo" ".deps/eeprom.Po"; else rm -f ".deps/eeprom.Tpo"; exit 1; fi
cc1: warnings being treated as errors
In file included from /usr/include/string.h:640,
from eeprom.c:30:
In function 'strncat',
inlined from 'eeprom_dump_core' at eeprom.c:395:
/usr/include/bits/string3.h:154: error: call to __builtin___strncat_chk might overflow destination buffer
make[4]: *** [eeprom.o] Error 1

This is due to wrong use of strncat(). The third parameter of this function limits the number of characters copied, not the total size of buffer.

The proposed fix (applies to as well) is:

--- simulavr-
+++ simulavr-
@@ -392,7 +392,7 @@
line[0] = '\0';
snprintf (buf, 80, "%02x ", storage_readb (eeprom->stor, i));
- strncat (line, buf, 80);
+ strncat (line, buf, 80 - strlen(line) - 1);
if (dup > 0)
--- simulavr-
+++ simulavr-
@@ -416,7 +416,7 @@
line[0] = '\0';
snprintf (buf, 80, "%02x ", mem_read (mem, i));
- strncat (line, buf, 80);
+ strncat (line, buf, 80 - strlen(line) - 1);
if (dup > 0)
--- simulavr-
+++ simulavr-
@@ -252,7 +252,7 @@
line[0] = '\0';
snprintf (buf, 80, "%04x ", flash_read (flash, i));
- strncat (line, buf, 80);
+ strncat (line, buf, 80 - strlen(line) - 1);
if (dup > 0)

Ilya Barygin <conscious>


(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):

No files currently attached


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -unavailable- added by tomk (Posted a comment)
  • -unavailable- added by petrh (Posted a comment)
  • -unavailable- added by conscious (Submitted the item)

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.


    Please enter the title of George Orwell's famous dystopian book (it's a date):



    Follow 2 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Mon Oct 6 17:05:16 2014tomkStatusNone=>Fixed

    Back to the top

    Powered by Savane 3.1-cleanup1