Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

d.labels: Fix buffer overflow issues in do_labels.c #4041

Merged
merged 17 commits into from
Jul 26, 2024

Conversation

ShubhamDesai
Copy link
Contributor

This pull request addresses multiple warnings identified by cppcheck related to potential buffer overflow issues.

Issues:

  1. do_labels.c:87:13: warning: sscanf() without field width limits can crash with huge input data. [invalidscanf]
    sscanf(text, "%*s %s", buff);
  2. do_labels.c:97:13: warning: sscanf() without field width limits can crash with huge input data. [invalidscanf]
    sscanf(text, "%*s %s", buff);
  3. do_labels.c:101:13: warning: sscanf() without field width limits can crash with huge input data. [invalidscanf]
    sscanf(text, "%*s %s", buff);
  4. do_labels.c:105:13: warning: sscanf() without field width limits can crash with huge input data. [invalidscanf]
    sscanf(text, "%*s %s", buff);
  5. do_labels.c:118:17: warning: sscanf() without field width limits can crash with huge input data. [invalidscanf]
    if (sscanf(text, "%*s %s", font) != 1 || !strcmp(font, "standard"))
  6. do_labels.c:126:13: warning: sscanf() without field width limits can crash with huge input data. [invalidscanf]
    sscanf(text, "%*s %s", buff);
  7. do_labels.c:455:13: warning: sscanf() without field width limits can crash with huge input data. [invalidscanf]
    switch (sscanf(buf, "%s%s", word1, word2))

Changes Made:
Added field width specifiers to the sscanf calls to prevent buffer overflows.

The field width is one less than the buffer size.
buff[128] -> %127s
font[256] -> %255s
word1[50], word2[50] -> %49s

@github-actions github-actions bot added C Related code is in C module display labels Jul 12, 2024
@ShubhamDesai ShubhamDesai changed the title display: Fix buffer overflow issues in do_labels.c d.labels: Fix buffer overflow issues in do_labels.c Jul 12, 2024
@nilason
Copy link
Contributor

nilason commented Jul 12, 2024

Please consider using pre-commit, which will solve e.g. clang-format issues before going to the CIs.

display/d.labels/do_labels.c Outdated Show resolved Hide resolved
Shubham Vasudeo Desai and others added 2 commits July 12, 2024 14:27
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Shubham Vasudeo Desai and others added 7 commits July 15, 2024 14:32
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Copy link
Contributor

@nilason nilason left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I added some minor suggestions below.

Also, please add the new size constant to the font[] variable at line 40.

display/d.labels/do_labels.c Outdated Show resolved Hide resolved
display/d.labels/do_labels.c Outdated Show resolved Hide resolved
display/d.labels/do_labels.c Outdated Show resolved Hide resolved
display/d.labels/do_labels.c Outdated Show resolved Hide resolved
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
display/d.labels/do_labels.c Outdated Show resolved Hide resolved
display/d.labels/do_labels.c Outdated Show resolved Hide resolved
@nilason nilason merged commit cd0687f into OSGeo:main Jul 26, 2024
26 checks passed
@nilason nilason added this to the 8.5.0 milestone Jul 26, 2024
Mahesh1998 pushed a commit to Mahesh1998/grass that referenced this pull request Sep 19, 2024
Addresses multiple warnings identified by cppcheck related to
potential buffer overflow issues. Added field width specifiers
to the sscanf calls to prevent buffer overflows.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
C Related code is in C display module
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants