From eb4bba89f7df5797fc8ce990b012959fd59808bf Mon Sep 17 00:00:00 2001 From: joseph calderon Date: Sun, 31 May 2026 09:30:33 -0700 Subject: [PATCH] Fix buffer overflows in temporary file generation --- src/common/normApi.cpp | 21 +++------------------ src/common/normApp.cpp | 20 +++----------------- 2 files changed, 6 insertions(+), 35 deletions(-) diff --git a/src/common/normApi.cpp b/src/common/normApi.cpp index 9764a3f..a151e94 100755 --- a/src/common/normApi.cpp +++ b/src/common/normApi.cpp @@ -271,29 +271,12 @@ void NormInstance::Notify(NormController::Event event, if (NULL != rx_cache_path) { char fileName[PATH_MAX]; - strncpy(fileName, rx_cache_path, PATH_MAX); - size_t catMax = strlen(fileName); - if (catMax > PATH_MAX) - catMax = 0; - else - catMax = PATH_MAX - catMax; - strncat(fileName, "normTempXXXXXX", catMax); - #ifdef WIN32 #ifdef _WIN32_WCE bool tempFileOK = false; for (int i = 0; i < 255; i++) { - strncpy(fileName, rx_cache_path, PATH_MAX); - catMax = strlen(fileName); - if (catMax > PATH_MAX) - catMax = 0; - else - catMax = PATH_MAX - catMax; - strncat(fileName, "normTempXXXXXX", catMax); - char tempName[16]; - sprintf(tempName, "normTemp%06u", i); - strcat(fileName, tempName); + snprintf(fileName, PATH_MAX, "%snormTemp%06u", rx_cache_path, i); if(!NormFile::IsLocked(fileName)) { tempFileOK = true; @@ -302,9 +285,11 @@ void NormInstance::Notify(NormController::Event event, } if (!tempFileOK) #else + snprintf(fileName, PATH_MAX, "%snormTempXXXXXX", rx_cache_path); if (!_mktemp(fileName)) #endif // if/else _WIN32_WCE #else + snprintf(fileName, PATH_MAX, "%snormTempXXXXXX", rx_cache_path); int fd = mkstemp(fileName); if (fd >= 0) { diff --git a/src/common/normApp.cpp b/src/common/normApp.cpp index 3771e8f..283d015 100755 --- a/src/common/normApp.cpp +++ b/src/common/normApp.cpp @@ -1718,28 +1718,12 @@ void NormApp::Notify(NormController::Event event, // we can use that for file name right away ??? // (TBD) Manage recv file name collisions, etc ... char fileName[PATH_MAX]; - strcpy(fileName, rx_cache_path); - size_t catMax = strlen(fileName); - if (catMax > PATH_MAX) - catMax = 0; - else - catMax = PATH_MAX - catMax; - strcat(fileName, "normTempXXXXXX"); #ifdef WIN32 #ifdef _WIN32_WCE bool tempFileOK = false; for (int i = 0; i < 255; i++) { - strncpy(fileName, rx_cache_path, PATH_MAX); - catMax = strlen(fileName); - if (catMax > PATH_MAX) - catMax = 0; - else - catMax = PATH_MAX - catMax; - strncat(fileName, "normTempXXXXXX", catMax); - char tempName[16]; - sprintf(tempName, "normTemp%06u", i); - strcat(fileName, tempName); + snprintf(fileName, PATH_MAX, "%snormTemp%06u", rx_cache_path, i); if(!NormFile::IsLocked(fileName)) { tempFileOK = true; @@ -1748,9 +1732,11 @@ void NormApp::Notify(NormController::Event event, } if (!tempFileOK) #else + snprintf(fileName, PATH_MAX, "%snormTempXXXXXX", rx_cache_path); if (!_mktemp(fileName)) #endif // if/else _WIN32_WCE #else + snprintf(fileName, PATH_MAX, "%snormTempXXXXXX", rx_cache_path); int fd = mkstemp(fileName); if (fd >= 0) {