libts / tslib

Touchscreen access library
GNU Lesser General Public License v2.1
596 stars 290 forks source link

ts_conf: Fix unbounded write by scanf() #205

Open szsam opened 1 year ago

szsam commented 1 year ago

Buffer write operations that do not control the length of data written may overflow.

Also, the scanf format string "%[^\n]s" is ill-formed. It contains two independent format specifiers: "%[^\n]" followed by a lone "s". This will direct scanf to read everything until \n is encountered (leaving \n unread), and then require that the next input character is s. This just doesn't make any sense. No input will match such self-contradictory format. Reference: https://stackoverflow.com/questions/8177752/scanf-ns-a-vs-getsa