diff options
| author | Christian Krinitsin <mail@krinitsin.com> | 2025-07-16 14:55:48 +0200 |
|---|---|---|
| committer | Christian Krinitsin <mail@krinitsin.com> | 2025-07-16 14:55:48 +0200 |
| commit | 63d2e9d409831aa8582787234cae4741847504b7 (patch) | |
| tree | 595fae753d2eb293437226eaab2eed208463f132 /results/scraper/box64/724 | |
| parent | 2843bb65aeaeb86eb89bf3d9690db61b9dc6306e (diff) | |
| download | qemu-analysis-box64.tar.gz qemu-analysis-box64.zip | |
add box64 bug reports box64
Diffstat (limited to 'results/scraper/box64/724')
| -rw-r--r-- | results/scraper/box64/724 | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/results/scraper/box64/724 b/results/scraper/box64/724 new file mode 100644 index 000000000..9a21848ac --- /dev/null +++ b/results/scraper/box64/724 @@ -0,0 +1,8 @@ +Incorrect strncat use +`strncat` function's third argument limits amount of bytes read from source (second arg), and not maximal allowed size of destination buffer (first arg) - https://linux.die.net/man/3/strncat + +If `HOME` envvar has length 4095, then 8 additional bytes will be written outside of buffer by the `strncat`. + +https://github.com/ptitSeb/box64/blob/60c6858916aa9e5332fad5cb52c448893e5bd2ef/src/main.c#L1217-L1231 + +Moreover, `tmp` should be initialized with terminating nullbyte before call to the `strncpy` (because the last byte may be not-null, if not explicitly set), or the call should be `strncpy(tmp, p, 4096);` with additional null-termination after call to the `strncpy`. |