Buffer copy without checking size of input

Wind4 / vlmcsd

KMS Emulator in C (currently runs on Linux including Android, FreeBSD, Solaris, Minix, Mac OS, iOS, Windows with or without Cygwin)

https://forums.mydigitallife.net/threads/50234

8.35k stars 2.22k forks source link

Closed jishanshaikh4 closed 3 years ago

jishanshaikh4 commented 3 years ago

Does not check for buffer overflows.

LABEL: Bug SEVERITY: Major SOLUTION: Use sprintf_s, snprintf, or vsnprintf. COMMON WEAKNESS ENUMERATION INDEX: CWE-120

Instances found in the GitHub repository:

ChlorideCull commented 3 years ago

The kms.c file is clean, the function allocates the string and limits the size of the number it's formatting into it.

While output.c does not follow best practices, there is no bug in it today.