[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-Id: <20250225132645.29523-1-ant.v.moryakov@gmail.com>
Date: Tue, 25 Feb 2025 16:26:46 +0300
From: Anton Moryakov <ant.v.moryakov@...il.com>
To: musl@...ts.openwall.com
Cc: Anton Moryakov <ant.v.moryakov@...il.com>
Subject: [PATCH] src: network: replace unsafe strcat with strncat in getnameinfo.c
Replaced the vulnerable `strcat` function with `strncat` to prevent
potential buffer overflow. The new implementation limits the number
of characters copied to the remaining space in the destination buffer,
ensuring safe string concatenation.
The change addresses the following warning:
/.build/src/network/getnameinfo.c:178
Use of vulnerable function 'strcat' at getnameinfo.c:178. This function
is unsafe, use strncat instead.
While it is unclear if the static analyzer correctly identified this
as a vulnerability, it is better to err on the side of caution and
make the code safer by using `strncat`. The fix calculates the
available space in the buffer using `sizeof(buf) - strlen(buf) - 1`
to leave room for the null terminator.
Triggers found by static analyzer Svace.
Signed-off-by: Anton Moryakov <ant.v.moryakov@...il.com>
---
src/network/getnameinfo.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/network/getnameinfo.c b/src/network/getnameinfo.c
index 133c15b3..e15f4457 100644
--- a/src/network/getnameinfo.c
+++ b/src/network/getnameinfo.c
@@ -179,7 +179,7 @@ int getnameinfo(const struct sockaddr *restrict sa, socklen_t sl,
if (!p)
p = itoa(num, scopeid);
*--p = '%';
- strcat(buf, p);
+ strncat(buf, p, sizeof(buf) - strlen(buf) - 1);
}
}
if (strlen(buf) >= nodelen) return EAI_OVERFLOW;
--
2.30.2
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
