search

SWI-Prolog / packages-sgml

The SWI-Prolog SGML/XML/HTML parser
4 stars 10 forks source link

SECURITY: This can still overflow. If swprintf() fails, it may write … #37

Closed thetrime closed 2 years ago

thetrime commented 4 years ago

…a character other than NULL to the last byte of the buffer. We need to set this explicitly after calling swprintf() and before trying to use the value. Technically we only have to set it if swprintf() returns a value < 0 but in practise it is not unsafe to do it in both cases and the code is less cluttered

JanWielemaker commented 2 years ago

Thanks! I see this is an old PR that was somehow missed!? It sill seems relevant. I'll check. Unfortunately it needs merging by hand.

JanWielemaker commented 2 years ago

Went though the patches, I see there is no issue as long as we trust wsprintf() not to write more characters than its maxlen as the 0 is always written after the maxlen. I can't find this branch anymore. Not sure what happened. Closing.