CF_TraverseHistory string buffer handling

[jphickey]

This issue was imported from the GSFC issue tracking system

Imported from: [GSFCCFS-1776] CF_TraverseHistory string buffer handling
Originally submitted by: Hickey, Joseph P. (GSFC-582.0)[VANTAGE SYSTEMS INC] on Tue Nov 16 14:22:27 2021

Original Description:
This issue was originally reported by IV&V, creating Jira issue to track its disposition and resolution.

Function CF_TraverseHistory() in cf_utils.c in the CF App source code, writes some text to the buffer 'linebuf' on line 70. This buffer, however, is overwritten on line 74 before it is written to the file descriptor on line 75. It is questionable whether this was the desired behavior.

[jphickey]

Imported comment by internal user on Tue Nov 16 14:24:57 2021

The report from IV&V is valid in that this overwrites some potentially desired parts of the human-readable output, but misses a potentially more significant issue in that the return value from snprintf in this block is then passed to the CF_WrappedWrite() function directly. However the return value from snprintf is not necessarily the length of the string. Using it as such may cause a read beyond the end of the valid buffer.

[jphickey]

Definitely need to fix this one, since it is a potential read beyond buffer bounds situation.