Skip to content

Commit

Permalink
fix crash under _FORTIFY_SOURCE
Browse files Browse the repository at this point in the history
when built with _FORTIFY_SOURCE it will check whether the buffer
has as much space as the argument passed to snprintf:

	https://github.com/bminor/glibc/blob/7b544224f82d20019f9b28522ebf8114a372d1a2/debug/snprintf_chk.c#L28-L29

this results in some false positives when the snprintf provided
len argument is bigger than the buffer size (but the result
would have fit into the buffer anyways).

fix this by passing the proper size to snprintf as argument.
(the +1 len isn't necessary, but add it just in case.)

Fixes: #1931
  • Loading branch information
N-R-K committed Nov 11, 2024
1 parent 614ebe7 commit 43c69ab
Showing 1 changed file with 4 additions and 3 deletions.
7 changes: 4 additions & 3 deletions src/nnn.c
Original file line number Diff line number Diff line change
Expand Up @@ -2834,15 +2834,16 @@ static char *get_archive_cmd(const char *archive)

static void archive_selection(const char *cmd, const char *archive)
{
char *buf = malloc((xstrlen(patterns[P_ARCHIVE_CMD]) + xstrlen(cmd) + xstrlen(archive)
+ xstrlen(selpath)) * sizeof(char));
size_t len = xstrlen(patterns[P_ARCHIVE_CMD]) + xstrlen(cmd) + xstrlen(archive)
+ xstrlen(selpath) + 1;
char *buf = malloc(len);

Check failure

Code scanning / CodeQL

Uncontrolled allocation size High

This allocation size is derived from
user input (an environment variable)
and could allocate arbitrary amounts of memory.
This allocation size is derived from
user input (an environment variable)
and could allocate arbitrary amounts of memory.
This allocation size is derived from
user input (an environment variable)
and could allocate arbitrary amounts of memory.
This allocation size is derived from
user input (an environment variable)
and could allocate arbitrary amounts of memory.
This allocation size is derived from
user input (buffer read by read)
and could allocate arbitrary amounts of memory.
This allocation size is derived from
user input (buffer read by read)
and could allocate arbitrary amounts of memory.
This allocation size is derived from
user input (buffer read by read)
and could allocate arbitrary amounts of memory.
This allocation size is derived from
user input (buffer read by read)
and could allocate arbitrary amounts of memory.
This allocation size is derived from
user input (buffer read by read)
and could allocate arbitrary amounts of memory.
This allocation size is derived from
user input (buffer read by read)
and could allocate arbitrary amounts of memory.
if (!buf) {
DPRINTF_S(strerror(errno));
printwarn(NULL);
return;
}

snprintf(buf, CMD_LEN_MAX, patterns[P_ARCHIVE_CMD], cmd, archive, selpath);
snprintf(buf, len, patterns[P_ARCHIVE_CMD], cmd, archive, selpath);
spawn(utils[UTIL_SH_EXEC], buf, NULL, NULL, F_CLI | F_CONFIRM);
free(buf);
}
Expand Down

0 comments on commit 43c69ab

Please sign in to comment.