voipmonitor / sniffer

VoIPmonitor sniffer sources
228 stars 107 forks source link

String copying boundary checking #3

Closed rgagnon24 closed 10 years ago

rgagnon24 commented 10 years ago

Changed most all sprintf() to snprintf() using target char[] for the size_t value of snprintf(). Added zero byte to end of every string after snprintf() as snprintf() may not properly terminate a string with null byte per its documentation.

Shortened some strings to sensible sizes as needed. IE: some do not need 255 or 1024 bytes in order to store 12-20 bytes.

voipmonitor commented 10 years ago

looks good but about - ENGINE=InnoDB DEFAULT CHARSET=latin1 - we do not know what would happen to leave that to default charset. At least all chars will take 2x space and char limits will be /2

2014-05-28 21:16 GMT+02:00 Rob Gagnon notifications@github.com:

Changed most all sprintf() to snprintf() using target char[] for the size_t value of snprintf(). Added zero byte to end of every string after snprintf() as snprintf() may not properly terminate a string with null byte per its documentation.

Shortened some strings to sensible sizes as needed. IE: some do not need

255 or 1024 bytes in order to store 12-20 bytes.

You can merge this Pull Request by running

git pull https://github.com/rgagnon24/sniffer develop

Or view, comment on, or merge it at:

https://github.com/voipmonitor/sniffer/pull/3 Commit Summary

  • Add boundary checking for string manipulation functions
  • More snprintf() for buffer-overrun protection

File Changes

  • M calltable.cpphttps://github.com/voipmonitor/sniffer/pull/3/files#diff-0(170)

Patch Links:

— Reply to this email directly or view it on GitHubhttps://github.com/voipmonitor/sniffer/pull/3 .

Best regards Martin Vit

voipmonitor commented 10 years ago

I have merged it but reverted the mysql changes

2014-05-28 21:16 GMT+02:00 Rob Gagnon notifications@github.com:

Changed most all sprintf() to snprintf() using target char[] for the size_t value of snprintf(). Added zero byte to end of every string after snprintf() as snprintf() may not properly terminate a string with null byte per its documentation.

Shortened some strings to sensible sizes as needed. IE: some do not need

255 or 1024 bytes in order to store 12-20 bytes.

You can merge this Pull Request by running

git pull https://github.com/rgagnon24/sniffer develop

Or view, comment on, or merge it at:

https://github.com/voipmonitor/sniffer/pull/3 Commit Summary

  • Add boundary checking for string manipulation functions
  • More snprintf() for buffer-overrun protection

File Changes

  • M calltable.cpphttps://github.com/voipmonitor/sniffer/pull/3/files#diff-0(170)

Patch Links:

— Reply to this email directly or view it on GitHubhttps://github.com/voipmonitor/sniffer/pull/3 .

Best regards Martin Vit