Skip to content
This repository has been archived by the owner on Jan 13, 2022. It is now read-only.

Fix possible buffer overrun #4

Closed
wants to merge 2 commits into from
Closed

Fix possible buffer overrun #4

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
8204abe
Fix possible buffer overrun (these arrays may be accessed at (1..512)…
jarikomppa Jul 8, 2014
ad7507c
sizeof() usage mistake reported by cppcheck
jarikomppa Jul 8, 2014
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions Source/PacketizedTCP.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -87,8 +87,8 @@ bool PacketizedTCP::SendList( const char **data, const unsigned int *lengths, co
#endif


unsigned int lengthsArray[512];
const char *dataArray[512];
unsigned int lengthsArray[513];
const char *dataArray[513];
Copy link

@Luke1410 Luke1410 Jun 2, 2018 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As @kfsone pointed out in his comment, increasing the array size is unnecessary. See the condition in the for-loop in line 94 which explicitly checks for i < 512 (in addition to i < numParameters). Not a common coding style I'd say (and therefore easily to overlook), but this should prevent any out of bounds access, no?

dataArray[0]=(char*) &dataLength;
lengthsArray[0]=sizeof(dataLength);
for (int i=0; i < 512 && i < numParameters; i++)
Expand Down
2 changes: 1 addition & 1 deletion Source/RakNetSocket2_Berkley_NativeClient.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ void DomainNameToIP_Berkley_IPV4And6( const char *domainName, char ip[65] )
hints.ai_socktype = SOCK_DGRAM;

if ((status = getaddrinfo(domainName, NULL, &hints, &res)) != 0) {
memset(ip, 0, sizeof(ip));
memset(ip, 0, 65); // sizeof(ip) returns pointer size, not array size
return;
}

Expand Down