Skip to content

fix: Bounds-check read_from_file restores with snprintf - #64

Open
VedantMadane wants to merge 2 commits into
RomanAlexandroff:mainfrom
VedantMadane:fix/issue-34
Open

VedantMadane wants to merge 2 commits into
RomanAlexandroff:mainfrom
VedantMadane:fix/issue-34

Conversation

@VedantMadane

Copy link
Copy Markdown

Summary

Bounds-check read_from_file restores with snprintf

Changes

  • file_system.cpp: replace strcpy with bounds-checked snprintf (4)

Fixes #34

@RomanAlexandroff RomanAlexandroff left a comment

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi and welcome!

In secret_verification() and data_integrity_check(), snprintf and sizeof will work just fine.

However, in read_from_file(), sizeof will not work as you expect because here 'output' is a pointer to the char array, not the array itself. Calling sizeof(output) will return the size of the pointer which on a 32-bit system is just 4 bytes, causing snprintf to always copy at most 3 characters + a nul-terminator.

Instead, you've got to calculate the size to copy first and then pass it into read_from_file() e.g. like this:
read_from_file(const char* file_name, char* output, size_t output_size)

@VedantMadane

Copy link
Copy Markdown
Author

Thank you for the review and explanation! I have updated
ead_from_file() to accept size_t output_size, updated the header declaration, and passed the explicit destination buffer sizes (sizeof(rtc_g.Secret) and sizeof(rtc_g.chat_id)) from
estore_data_value().

Signed-off-by: Vedant Madane <6527493+VedantMadane@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Issue] Missing bounds checking in read_from_file()

2 participants