提交 d89c5776 编写于 作者: D Daniel Gustafsson

Fix potential overflow in mpp_err_msg_cache()

Saving the error message into the static buffer can lead to overflow
since the string copy isn't bounded. Move to using a bounded copy and
also indicate truncated messages by ending them with ".."

Considering that this doesn't seem to have happened indicates that it's
not worth dynamically extending/shrinking the buffer to cope with the
input, simply ensuring to not overflow is probably enough.
上级 2ac3369a
......@@ -619,6 +619,7 @@ mpp_err_msg_cache(const char *loglevel, const char *prog, const char *fmt,...)
{
va_list ap;
char szTimeNow[18];
int len;
va_start(ap, fmt);
fprintf(stderr, "%s|%s-[%s]:-", GetTimeNow(szTimeNow), prog, loglevel);
......@@ -627,8 +628,19 @@ mpp_err_msg_cache(const char *loglevel, const char *prog, const char *fmt,...)
/* cache a copy of the message - we may need it for a report */
va_start(ap, fmt);
vsprintf(predump_errmsg, gettext(fmt), ap);
len = vsnprintf(predump_errmsg, sizeof(predump_errmsg), gettext(fmt), ap);
va_end(ap);
/*
* If the passed error string exceeds the size of the buffer, indicate that
* by suffixing the string with ".."
*/
if (len > sizeof(predump_errmsg))
{
int i;
for (i = sizeof(predump_errmsg) - 3; predump_errmsg[i]; i++)
predump_errmsg[i] = '.';
}
}
/* Simple error logging to stdout */
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册