IOTechSystems / iotech-c-utils

Apache License 2.0
9 stars 7 forks source link

XRT-2534: Fix Buffer Overflow in Environmental Variable Parsing #309

Closed Jwcode-uk closed 12 months ago

Jwcode-uk commented 1 year ago

Previously, the code was using a fixed-size buffer to store the parsed environmental variable name, which could lead to a buffer overflow if the variable name exceeded the buffer size. This PR replaces the fixed-size buffer with a dynamically allocated string, ensuring that the buffer is always the correct size for the data it holds.

edward-scott commented 12 months ago

There is one approach that I suggested to Johnathan that could be used if the malloc was too expensive: write a null terminator temporarily into the json string at the end of the environment variable name. Since we would be replacing that part of the string it seems a viable approach.

Jwcode-uk commented 12 months ago

Made the change Ed proposed in this PR if you want to go ahead with it -> #311 :)