bugGPSD - Bugs: bug #44047, Incorrect uses of...

 
 

bug #44047: Incorrect uses of snprintf/strlcat/strlcpy in gpsd_binary_XXX_dump functions

Submitted by:  Zbigniew Chyla <zchyla_nokia>
Submitted on:  Mon 19 Jan 2015 02:49:47 PM UTC  
 
Category: NoneSeverity: 3 - Normal
Item Group: NoneStatus: Fixed
Privacy: PublicAssigned to: Eric S. Raymond <esr>
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Mon 19 Jan 2015 02:57:00 PM UTC, comment #1:

The attached patches fix both functions by using str_appendf() from #44025.

“scons check” passes without errors.

(file #32863, file #32864, file #32865, file #32866)

Zbigniew Chyla <zchyla_nokia>
Mon 19 Jan 2015 02:49:47 PM UTC, original submission:

gpsd_binary_satellite_dump:

The function updates 'len' three times by using the results of snprintf() calls, which is wrong, since snprintf() returns the number of characters which would have been written if enough space had been available, not necessarily the number of characters actually written.

Additionally, after appending "$PRWIZCH" to the buffer the code doesn't update 'len' at all.


gpsd_binary_quality_dump:

The function doesn't modify 'len', so it always contains the size of the output buffer. On the other hand, the function does modify 'bufp', pointing it to the end of generated string. It means, that the following code is incorrect:

In the second line "strlen(bufp)" will be zero, so we're effectively calling "snprintf(bufp, len, ..." with 'bufp' pointing inside the buffer and 'len' containing full length of the buffer.

A few lines later we have similar incorrect code (this time without subtracting zero strlen()):

... and again, both variants in single "if" statement:

Zbigniew Chyla <zchyla_nokia>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by esr (Updated the item)
  • -unavailable- added by zchyla_nokia (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 7 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sun 22 Feb 2015 05:03:02 PM UTCesrOpen/ClosedOpen=>Closed
    Wed 21 Jan 2015 06:01:49 PM UTCesrStatusNone=>Fixed
      Assigned toNone=>esr
    Mon 19 Jan 2015 02:57:00 PM UTCzchyla_nokiaAttached File-=>Added 0001-Fix-incorrect-uses-of-snprintf-in-gpsd_binary_satell.patch, #32863
      Attached File-=>Added 0002-Use-better-name-for-local-var.patch, #32864
      Attached File-=>Added 0003-Fix-incorrect-uses-of-snprintf-strlcpy-in-gpsd_binar.patch, #32865
      Attached File-=>Added 0004-Use-better-name-for-local-var.patch, #32866

    Back to the top


    Powered by Savane 3.1-cleanup1