CERBERUS/nmap
1
0
Fork 0
mirror of https://github.com/nmap/nmap.git synced 2026-08-04 14:49:29 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Corrects a few issues related to snprintf return values

Browse source
This commit is contained in:
nnposter 2018-08-26 02:29:14 +00:00
parent d22dbc63b8
commit 973b471c11
4 changed files with 10 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

2
NmapOutputTable.cc
View file

@ -233,7 +233,7 @@ void NmapOutputTable::addItemFormatted(unsigned int row,
res = Vsnprintf(buf, sizeof(buf), fmt, ap);
va_end(ap);
if (res > sizeof(buf))
if (res >= sizeof(buf))
fatal("NmapOutputTable only supports adding up to 4096 to a cell via %s.", __func__);
addItem(row, column, fullrow, true, buf, res);

2
nbase/nbase_str.c
View file

@ -196,7 +196,7 @@ int Vsnprintf(char *s, size_t n, const char *fmt, va_list ap) {
ret = vsnprintf(s, n, fmt, ap);
if (ret < 0 || (unsigned)ret >= n)
s[n - 1] = '\0';
s[n - 1] = '\0'; /* technically redundant */
return ret;
}

12
nsock/src/nsock_write.c
View file

@ -170,6 +170,7 @@ nsock_event_id nsock_printf(nsock_pool ms_pool, nsock_iod ms_iod,
struct nevent *nse;
char buf[4096];
char *buf2 = NULL;
size_t buf2size;
int res, res2;
int strlength = 0;
char displaystr[256];
@ -183,13 +184,14 @@ nsock_event_id nsock_printf(nsock_pool ms_pool, nsock_iod ms_iod,
res = Vsnprintf(buf, sizeof(buf), format, ap);
va_end(ap);
if (res != -1) {
if (res > sizeof(buf)) {
buf2 = (char * )safe_malloc(res + 16);
if (res >= 0) {
if (res >= sizeof(buf)) {
buf2size = res + 16;
buf2 = (char * )safe_malloc(buf2size);
va_start(ap,format);
res2 = Vsnprintf(buf2, sizeof(buf), format, ap);
res2 = Vsnprintf(buf2, buf2size, format, ap);
va_end(ap);
if (res2 == -1 || res2 > res) {
if (res2 < 0 || res2 >= buf2size) {
free(buf2);
buf2 = NULL;
} else

2
service_scan.cc
View file

@ -896,7 +896,7 @@ static char *substvar(char *tmplvar, char **tmplvarend,
}
}
buflen = Snprintf(buf, sizeof(buf), "%lu", val);
if (buflen < 0 || buflen > (int) sizeof(buf)) {
if (buflen < 0 || buflen >= (int) sizeof(buf)) {
return NULL;
}
strbuf_append(&result, &n, &len, buf, buflen);