Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(parse_def): prevent buffer overflow in register name copy #23942

Merged
merged 2 commits into from
Feb 4, 2025

Conversation

Reodus
Copy link
Contributor

@Reodus Reodus commented Feb 3, 2025

Buffer Overflow in arch_parse_reg_profile and parse_def

Description:

In the parse_def function, r->name is a buffer that holds the name of a register. However, it is only 32 bytes in size. But in the arch_parse_reg_profile function, there is a buffer tmp which is 128 bytes long and is used to hold parsed tokens from the reg_profile string.

As you see in parse_def, The strcpy function is used to copy the string from tok[1] into r->name and there is no check to ensure that tok[1] will fit into r->name (which is only 32 bytes). To fix this issue, I replaced strcpy with snprintf, which allows you to specify the maximum size of the destination buffer, ensuring that the string is copied safely and that the buffer boundary is respected.

shlr/gdb/src/arch.c Outdated Show resolved Hide resolved
shlr/gdb/src/arch.c Outdated Show resolved Hide resolved
@Reodus Reodus requested a review from trufae February 4, 2025 13:06
@trufae trufae merged commit 46c725d into radareorg:master Feb 4, 2025
@trufae
Copy link
Collaborator

trufae commented Feb 4, 2025

Thank you

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants