BodgeMaster
/
NORM-mirror
mirror of https://github.com/USNavalResearchLaboratory/norm.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fix buffer overflows in temporary file generation

pull/101/head
joseph calderon 2026-05-31 09:30:33 -07:00
parent f2f363b6aa
commit eb4bba89f7
2 changed files with 6 additions and 35 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
src/common/normApi.cpp
View File

@ -271,29 +271,12 @@ void NormInstance::Notify(NormController::Event event,
if (NULL != rx_cache_path) if (NULL != rx_cache_path)
{ {
char fileName[PATH_MAX]; char fileName[PATH_MAX];
strncpy(fileName, rx_cache_path, PATH_MAX);
size_t catMax = strlen(fileName);
if (catMax > PATH_MAX)
catMax = 0;
else
catMax = PATH_MAX - catMax;
strncat(fileName, "normTempXXXXXX", catMax);
#ifdef WIN32 #ifdef WIN32
#ifdef _WIN32_WCE #ifdef _WIN32_WCE
bool tempFileOK = false; bool tempFileOK = false;
for (int i = 0; i < 255; i++) for (int i = 0; i < 255; i++)
{ {
strncpy(fileName, rx_cache_path, PATH_MAX); snprintf(fileName, PATH_MAX, "%snormTemp%06u", rx_cache_path, i);
catMax = strlen(fileName);
if (catMax > PATH_MAX)
catMax = 0;
else
catMax = PATH_MAX - catMax;
strncat(fileName, "normTempXXXXXX", catMax);
char tempName[16];
sprintf(tempName, "normTemp%06u", i);
strcat(fileName, tempName);
if(!NormFile::IsLocked(fileName)) if(!NormFile::IsLocked(fileName))
{ {
tempFileOK = true; tempFileOK = true;
@ -302,9 +285,11 @@ void NormInstance::Notify(NormController::Event event,
} }
if (!tempFileOK) if (!tempFileOK)
#else #else
snprintf(fileName, PATH_MAX, "%snormTempXXXXXX", rx_cache_path);
if (!_mktemp(fileName)) if (!_mktemp(fileName))
#endif // if/else _WIN32_WCE #endif // if/else _WIN32_WCE
#else #else
snprintf(fileName, PATH_MAX, "%snormTempXXXXXX", rx_cache_path);
int fd = mkstemp(fileName); int fd = mkstemp(fileName);
if (fd >= 0) if (fd >= 0)
{ {

20
src/common/normApp.cpp
View File

@ -1718,28 +1718,12 @@ void NormApp::Notify(NormController::Event event,
// we can use that for file name right away ??? // we can use that for file name right away ???
// (TBD) Manage recv file name collisions, etc ... // (TBD) Manage recv file name collisions, etc ...
char fileName[PATH_MAX]; char fileName[PATH_MAX];
strcpy(fileName, rx_cache_path);
size_t catMax = strlen(fileName);
if (catMax > PATH_MAX)
catMax = 0;
else
catMax = PATH_MAX - catMax;
strcat(fileName, "normTempXXXXXX");
#ifdef WIN32 #ifdef WIN32
#ifdef _WIN32_WCE #ifdef _WIN32_WCE
bool tempFileOK = false; bool tempFileOK = false;
for (int i = 0; i < 255; i++) for (int i = 0; i < 255; i++)
{ {
strncpy(fileName, rx_cache_path, PATH_MAX); snprintf(fileName, PATH_MAX, "%snormTemp%06u", rx_cache_path, i);
catMax = strlen(fileName);
if (catMax > PATH_MAX)
catMax = 0;
else
catMax = PATH_MAX - catMax;
strncat(fileName, "normTempXXXXXX", catMax);
char tempName[16];
sprintf(tempName, "normTemp%06u", i);
strcat(fileName, tempName);
if(!NormFile::IsLocked(fileName)) if(!NormFile::IsLocked(fileName))
{ {
tempFileOK = true; tempFileOK = true;
@ -1748,9 +1732,11 @@ void NormApp::Notify(NormController::Event event,
} }
if (!tempFileOK) if (!tempFileOK)
#else #else
snprintf(fileName, PATH_MAX, "%snormTempXXXXXX", rx_cache_path);
if (!_mktemp(fileName)) if (!_mktemp(fileName))
#endif // if/else _WIN32_WCE #endif // if/else _WIN32_WCE
#else #else
snprintf(fileName, PATH_MAX, "%snormTempXXXXXX", rx_cache_path);
int fd = mkstemp(fileName); int fd = mkstemp(fileName);
if (fd >= 0) if (fd >= 0)
{ {