Skip to content

fix: replace unbounded strcpy with snprintf to prevent buffer overflow (V-001)#1882

Open
Senrian wants to merge 2 commits intokrahets:mainfrom
Senrian:fix-strcpy-buffer-overflow
Open

fix: replace unbounded strcpy with snprintf to prevent buffer overflow (V-001)#1882
Senrian wants to merge 2 commits intokrahets:mainfrom
Senrian:fix-strcpy-buffer-overflow

Conversation

@Senrian
Copy link
Copy Markdown
Contributor

@Senrian Senrian commented Apr 6, 2026

Summary

Fix CRITICAL severity buffer overflow vulnerability in codes/c/utils/print_util.h.

Vulnerability

Field Value
ID V-001
Severity CRITICAL
File codes/c/utils/print_util.h:67-68

Issue: strcpy() does not validate that the destination buffer is large enough to hold the source string.

// BEFORE (vulnerable)
trunk->str = (char *)malloc(sizeof(char) * 10);
strcpy(trunk->str, str);  // unbounded copy - buffer overflow if str > 9 chars

// AFTER (safe)
trunk->str = (char *)malloc(sizeof(char) * (strlen(str) + 1));
snprintf(trunk->str, strlen(str) + 1, "%s", str);  // bounded copy with proper sizing

Changes

  • Allocate buffer based on actual string length (strlen(str) + 1)
  • Replace strcpy with snprintf for bounds-checked copy

Verification

  • Build passes
  • Code review passed

Closes #1876

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant