search

rxi / aria

A tiny, embeddable lisp-shaped language implemented in C89
MIT License
169 stars 16 forks source link

Potential Buffer Overflow in ar_error_str #1

Open pendingchaos opened 8 years ago

pendingchaos commented 8 years ago

https://github.com/rxi/aria/blob/7c5d6c05a3f136e8aa5f33a4715dff756316fa64/aria.c#L1386-L1391 An safer alternative to vsprintf is vsnprintf but it is not available in C89.

rxi commented 8 years ago

I was aware of this already, and am not using vsnprintf for the reason you mentioned. Additionally I'm not in favour of implementing a subset of printf formatting directly; one of the project's main goals is to be a small and easy to understand implementation.

ar_error_str() was meant to be used for short error messages which are guaranteed not to exceed 511 characters -- such that it should never be used to make an error from a user inputted string of arbitrary length, for example -- I'm aware none of this is mentioned anywhere.

For longer error messages, a combination of ar_new_string() and ar_error() should be used.

Though it perhaps isn't ideal, I feel this issue is only one of lack of documentation. Leaving the issue open as it does better to serve as some documentation to this function's intended use case.