search

resurrecting-open-source-projects / scrot

SCReenshOT - command line screen capture utility
Other
511 stars 51 forks source link

imPrintf goes out of bound #252

Closed N-R-K closed 1 year ago

N-R-K commented 1 year ago

If the last character of a filename is $ or \ then the c pointer can end up advancing past the end of the string.

https://github.com/resurrecting-open-source-projects/scrot/blob/7932f280d798cdb1d29174963e17cd41f6ce6691/src/scrot.c#L670-L672

Assuming $ was the last character, this will push \0 into ret and then c will be incremented past the end of the string on the next loop iteration.

guijan commented 1 year ago

I haven't looked deeply into the code yet but a pointer to one past the end of an object isn't UB.

N-R-K commented 1 year ago

I haven't looked deeply into the code yet but a pointer to one past the end of an object isn't UB.

I'm aware. It's not about the pointer itself. But because the pointer goes past the nul-byte, it will start reading uninitialized memory.