service_scan: increase probe file line buffer and add truncation error - #3367
Closed
Ashutosh-177 wants to merge 2 commits into
Closed
service_scan: increase probe file line buffer and add truncation error#3367Ashutosh-177 wants to merge 2 commits into
Ashutosh-177 wants to merge 2 commits into
Conversation
The 2048-byte line buffer in parse_nmap_service_probe_file() silently truncates any probe definition longer than 2047 characters. A QUIC UDP probe legitimately exceeds this limit and produces a misleading "unexpected Probe token" fatal error instead of a clear "line too long" message. Increase the buffer to 16 KB, which comfortably fits all current and anticipated probe entries. Add a truncation guard immediately after fgets() that fires a descriptive fatal() if a line fills the buffer without a trailing newline, making future overflow obvious rather than silent. Fixes nmap#3201 Signed-off-by: Ashutosh Kumar Singh <ahutoshhjp1067@gmail.com>
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
Updates parse_nmap_service_probe_file to support longer lines and to explicitly fail fast when encountering probe file lines that exceed the configured buffer size.
Changes:
- Increased the probe-file line buffer from 2,048 to 16,384 bytes.
- Added detection of truncated
fgetsreads and afatal()error when a line exceeds the buffer.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Author
|
@copilot apply changes based on the comments in this thread |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The line buffer in parse_nmap_service_probe_file() is 2048 bytes. fgets() silently truncates anything longer without any indication that data was lost. When this happens with a Probe line, the rest of the token is read as the next line and triggers a fatal "unexpected Probe token" error -- not very helpful for figuring out what went wrong.
This came up with the QUIC UDP probe, which is longer than 2047 bytes. Instead of a clear "this line is too long" message you just get a confusing parse failure.
The fix bumps the buffer to 16 KB (plenty of headroom for any realistic probe definition) and adds a check right after fgets() that detects when the buffer was filled without reaching a newline. If that happens while not at EOF, it's a definitive truncation and we emit a fatal error with the line number and the actual limit, making future overflows obvious instead of silent.
Fixes #3201