eosnetworkfoundation / ledger-app

EOS app for ledger devices
Apache License 2.0
1 stars 0 forks source link

Secure String Copy in eos_parse #6

Closed ericpassmore closed 2 years ago

ericpassmore commented 2 years ago

src/eos_parse.c:210:5: warning: Call to function 'strcat' is insecure as it does not provide bounding of the memory buffer. Replace unbounded copy functions with analogous functions that support length arguments such as 'strlcat'. CWE-119 [security.insecureAPI.strcpy] strcat(arg->data, "@"); ^~

ericpassmore commented 2 years ago

from strcat(arg->data, "@"); to strlcat(arg->data, "@", 1);

ericpassmore commented 2 years ago

actionArgument_t.data is char[128].

greg7mdp commented 2 years ago

see https://linux.die.net/man/3/strlcpy, last argument should be the full size of the buffer, so sizeof(arg->data) in this case.