From 5f0106a096c6b235f40f7cdaab54c51bc0989e9f Mon Sep 17 00:00:00 2001 From: Jarrett Johnson Date: Sat, 11 May 2024 14:18:09 -0400 Subject: [PATCH] Fix champ mem alloc file buffer overflow --- contrib/champ/os_memory.c | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-) diff --git a/contrib/champ/os_memory.c b/contrib/champ/os_memory.c index cc26984f9..5b38ccfa4 100644 --- a/contrib/champ/os_memory.c +++ b/contrib/champ/os_memory.c @@ -176,7 +176,15 @@ void *OSMemoryMalloc(unsigned int size,const char *file,int line,int type) rec=(DebugRec*)malloc(sizeof(DebugRec)+size); if(!rec) return(NULL); - strcpy(rec->file,file); + + int len = strlen(file); + int max_size = sizeof(rec->file) - 1; + if (len > max_size) { + strcpy(rec->file, file + len - max_size); + } else { + strcpy(rec->file, file); + } + rec->file[max_size - 1] = '\0'; rec->line=line; rec->size=size; rec->type=type; @@ -196,7 +204,15 @@ void *OSMemoryCalloc(unsigned int count,unsigned int size,const char *file,int l rec=(DebugRec*)calloc(1,sizeof(DebugRec)+size); if(!rec) return(NULL); - strcpy(rec->file,file); + + int len = strlen(file); + int max_size = sizeof(rec->file) - 1; + if (len > max_size) { + strcpy(rec->file, file + len - max_size); + } else { + strcpy(rec->file, file); + } + rec->file[max_size - 1] = '\0'; rec->line=line; rec->size=size; rec->type=type;