Skip to content

D1-mini : Buffer Overflow on Reading Long Configuration File Lines #21

Description

@dennowiggle

In function handleCharacterRom() in file "rServer.cpp" buffer overflow can occur when reading the config file if a line is longer than 128 characters such as a comment line. This happened to me resulting in a segmentation fault and crash.

Fix is to limit reads to 128 bytes maximum. Add the start of the file add the following

#define MAX_LINE_CHARS 128

Line 158 change
char line[128];
to
char line[MAX_LINE_CHARS];

Between line 215 and 216 add
if (numchars > MAX_LINE_CHARS) numchars = MAX_LINE_CHARS

such that the code now looks like this
while (!found)
{
while (*end != '\n' && *end != 0 && end - tableBegin < enableTableLen) {
end++;
}

    int numchars = end-start;  
    if (numchars > MAX_LINE_CHARS) numchars = MAX_LINE_CHARS;
    strncpy(line, start, numchars);
    line[numchars] = 0;

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions