marlin
"Stack buffer overflow is empty string
If SDSUPPORT is enabled, an error occurs due to the omission of allocating space for / character for the full path of the item that it is read. Issue 2434: https://github.com/MarlinFirmware/Marlin/issues/2434"
Bug fixed by commit a7fc1f83c81
| Type | StackBasedBufferOverflow |
| Config | "SDSUPPORT" (1st degree) |
| Fix-in | mapping |
| Location | cardreader/ |
#include<string.h>
/** Number of UTF-16 characters per entry */
#define FILENAME_LENGTH 13
#ifdef SDSUPPORT
void cardreader(char *prepend)
{
int len = strlen(prepend) + FILENAME_LENGTH + 1; // Error - not enough space allocated if prepend is empty
char path[len];
// Get the short name for the item, which we know is a folder
//char lfilename[FILENAME_LENGTH];
//createFilename(lfilename, p);
char lfilename[FILENAME_LENGTH] = "FOLDERNAME12\0";
// Append the FOLDERNAME12/ to the passed string.
// It contains the full path to the "parent" argument.
// We now have the full path to the item in this folder.
path[0] = '\0';
if (prepend[0] == '\0') strcat(path, "/"); // a root slash if prepend is empty
strcat(path, prepend);
strcat(path, lfilename);
strcat(path, "/");
}
#endif
int main(int argc, char **argv)
{
cardreader("");
return 0;
}
diff --git a/simple/a7fc1f8.c b/simple/a7fc1f8.c
--- a/simple/a7fc1f8.c
+++ b/simple/a7fc1f8.c
@@ -7,7 +7,7 @@
void cardreader(char *prepend)
{
- int len = strlen(prepend) + FILENAME_LENGTH + 1; // Error - not enough space allocated if prepend is empty
+ int len = strlen(prepend) + FILENAME_LENGTH + 1 + 1;
char path[len];
// Get the short name for the item, which we know is a folder
//char lfilename[FILENAME_LENGTH];
#include<string.h>
/** Number of UTF-16 characters per entry */
#define FILENAME_LENGTH 13
int main(int argc, char **argv)
{
#ifdef SDSUPPORT
char *prepend = "";
int len = strlen(prepend) + FILENAME_LENGTH + 1; // Error - not enough space allocated if prepend is empty
char path[len];
// Get the short name for the item, which we know is a folder
//char lfilename[FILENAME_LENGTH];
//createFilename(lfilename, p);
char lfilename[FILENAME_LENGTH] = "FOLDERNAME12\0";
// Append the FOLDERNAME12/ to the passed string.
// It contains the full path to the "parent" argument.
// We now have the full path to the item in this folder.
path[0] = '\0';
if (prepend[0] == '\0') strcat(path, "/"); // a root slash if prepend is empty
strcat(path, prepend);
strcat(path, lfilename);
strcat(path, "/");
#endif
return 0;
}
. call cardreader.cpp:49: void CardReader::lsDive() . 59: // Allocate enough stack space for the full path to a folder . 60: int len = strlen(prepend) + FILENAME_LENGTH + 1; //This does not consider the last appended trailing slash (line 74) in the allocation of memory, resulting in a stack buffer overflow . 71: if (prepend[0] == '\0') strcat(path, "/"); // a root slash if prepend is empty . 72: strcat(path, prepend); . 73: strcat(path, lfilename); . ERROR: cardreader.cpp: 74 strcat(path, "/");