Possible overflow in sprint_realloc_timeticks

[sgmr29]

Regarding these lines:

net-snmp/snmplib/mib.c

Lines 1195 to 1196 in 8fdec0d

	char str[32];
	sprintf(str, "Timeticks: (%lu) ", *(u_long *) var->val.integer);

The format string contains 14 constant characters, and a 64 bit unsigned integer could take 20 characters, and then you need a null terminator. That's 35 by my count, which would be bigger than the buffer.

[nielsb]

Den 26-08-2020 kl. 17:35 skrev sgmr29:

Regarding these lines: https://github.com/net-snmp/net-snmp/blob/8fdec0d613eff11c084ceffe34b9318e752c5352/snmplib/mib.c#L1195-L1196 <https://github.com/net-snmp/net-snmp/blob/8fdec0d613eff11c084ceffe34b9318e752c5352/snmplib/mib.c#L1195-L1196> The format string contains 14 constant characters, and a 64 bit unsigned integer could take 20 characters, and then you need a null terminator. That's 35 by my count, which would be bigger than the buffer.

But the definition of TimeTicks is TimeTicks ::= [APPLICATION 3] IMPLICIT INTEGER (0..4294967295) which is a maximum of 10 characters, which leaves plenty of room in the buffer (and the value is range checked during decoding) /Niels

…

-- Niels Baggesen - @home - Århus - Denmark - nba@users.sourceforge.net The purpose of computing is insight, not numbers --- R W Hamming