search

universam1 / iSpindel

electronic Hydrometer
http://www.ispindel.de
Other
827 stars 322 forks source link

Possible bufferoverflow in validateInput #463

Closed MarcoCLA closed 3 years ago

MarcoCLA commented 3 years ago

The validateInput function uses the length of the string instead of the length of the chararray. https://github.com/universam1/iSpindel/blob/499d358af8423906653e9b0dd1e2bc69fa47b7f7/pio/src/iSpindel.cpp#L299

The length of the chararray is TKIDSIZE https://github.com/universam1/iSpindel/blob/499d358af8423906653e9b0dd1e2bc69fa47b7f7/pio/src/iSpindel.cpp#L70 The parameter is initialized as TKIDSIZE x 2 WiFiManagerParameter custom_name("name", "iSpindel Name", htmlencode(my_name).c_str(), TKIDSIZE * 2); So it will strncpy TKIDSIZE x 2 instead of the TKIDSIZE chararray in the validateInput function. This happens for multiple parameters.

toCharArray and getBytes for reference.

universam1 commented 3 years ago

Thanks for the investigation, would you like to create a fix?

stale[bot] commented 3 years ago

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.