Skip to content

Commit 15a18e5

Browse files
szsammerge
authored andcommitted
ts_conf: Fix unbounded write by scanf()
Buffer write operations that do not control the length of data written may overflow. Also, the scanf format string "%[^\n]s" is ill-formed. It contains two independent format specifiers: "%[^\n]" followed by a lone "s". This will direct scanf to read everything until \n is encountered (leaving \n unread), and then require that the next input character is s. This just doesn't make any sense. No input will match such self-contradictory format. Reference: https://stackoverflow.com/questions/8177752/scanf-ns-a-vs-getsa
1 parent 3576e2f commit 15a18e5

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

tests/ts_conf.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -144,14 +144,14 @@ static int add_line_after(struct ts_module_conf *conf)
144144
goto err;
145145

146146
printf("new module name without parameters: ");
147-
ret = scanf("%s", new_filter->name);
147+
ret = scanf("%1023s", new_filter->name);
148148
if (ret <= 0) {
149149
perror("scanf");
150150
goto err;
151151
}
152152
printf("parameters: ");
153153
while ((c = getchar()) != '\n' && c != EOF) { }
154-
ret = scanf("%[^\n]s", new_filter->params);
154+
ret = scanf("%1023[^\n]", new_filter->params);
155155
if (ret < 0)
156156
goto err;
157157
new_filter->nr = ++nr;

0 commit comments

Comments
 (0)