airspy / airspyone_host

AirSpy's usemode driver and associated tools
http://airspy.com
245 stars 88 forks source link

Fix stack buffer overflow in airspy_version_string_read() #90

Closed sergeyvfx closed 1 year ago

sergeyvfx commented 1 year ago

If one follows the comment about length needing to be at least 128 and passes string of the maximum possible size of 255 this function used to access stack memory past the local buffer.

Now the local buffer is zeroed out, and only maximum possible number if bytes are copied, taking into account both local buffer and the version string sizes. This makes it possible to pass string buffer both larger or smaller than the local buffer without any memory access past the buffer boundaries.

Adjusted the comment in the header stating that the string needs to be of a certain size to avoid clipping.

There should be no changes from the API or behavior point of view.

bvernoux commented 1 year ago

Thanks for your contribution to have more robust code