Skip to content

Commit

Permalink
remove potential dangerous pointer access
Browse files Browse the repository at this point in the history
  • Loading branch information
@rofl0r
rofl0r committed Oct 26, 2011
1 parent 362a641 commit 223d18a
Showing 1 changed file with 3 additions and 2 deletions.
5 changes: 3 additions & 2 deletions display.c
View file
Original file line number Original file line Diff line number Diff line change
Expand Up @@ -266,13 +266,14 @@ void ungetstr(char *s)
int get_number(INT *i) int get_number(INT *i)
{ {
int err; int err;
long long i_cast = *i;
char tmp[BLOCK_SEARCH_SIZE]; char tmp[BLOCK_SEARCH_SIZE];
echo(); echo();
getnstr(tmp, BLOCK_SEARCH_SIZE - 1); getnstr(tmp, BLOCK_SEARCH_SIZE - 1);
noecho(); noecho();
if (strbeginswith(tmp, "0x")) if (strbeginswith(tmp, "0x"))
err = sscanf(tmp + strlen("0x"), "%llx", i); err = sscanf(tmp + strlen("0x"), "%llx", &i_cast);
else else
err = sscanf(tmp, "%lld", i); err = sscanf(tmp, "%lld", &i_cast);
return err == 1; return err == 1;
} }

3 comments on commit 223d18a

@pixel
Copy link

@pixel pixel commented on 223d18a May 9, 2012

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi,

I'm the author of hexedit (available here: https://github.com/pixel/hexedit).

I was reviewing your commits for inclusion. But i really don't understand your commit: in function get_number, "i" parameter is OUT, not IN.
I would have do the following:

  • sscanf on tmp_i
  • at the end *i = tmp_i;

@rofl0r
Copy link
Owner Author

@rofl0r rofl0r commented on 223d18a May 9, 2012

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

you are right, fixed in e0870a0

@rofl0r
Copy link
Owner Author

@rofl0r rofl0r commented on 223d18a May 9, 2012

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

i hope you see the issue that the old code would overwrite random memory if off_t happens to be 32bit?
scanf assumes it gets a pointer to a long long.
(found via gcc warnings)

Please sign in to comment.