sfeakes#135: Buffer overflow in action_web_request

ballle98 · ballle98 · commit f59b3c89f6fd · 2024-06-11T09:44:41.000-05:00
diff --git a/net_services.c b/net_services.c
@@ -1589,8 +1589,8 @@ void action_web_request(struct mg_connection *nc, struct http_message *http_msg)
       mg_send_head(nc, 200, strlen(GET_RTN_UNKNOWN), CONTENT_TEXT);
       mg_send(nc, GET_RTN_UNKNOWN, strlen(GET_RTN_UNKNOWN));
     }
-
-    sprintf(buf, "action_web_request() request '%.*s' took",(int)http_msg->uri.len, http_msg->uri.p);
+    snprintf(buf, sizeof(buf), "action_web_request() request '%.*s' took",
+             (int)http_msg->uri.len, http_msg->uri.p);
 
     DEBUG_TIMER_STOP(tid, NET_LOG, buf);
   }
@@ -2171,4 +2171,4 @@ bool start_net_services(/*struct mg_mgr *mgr, */struct aqualinkdata *aqdata)
   return true;
 }
 
-#endif
+#endif

Original file line number	Diff line number	Diff line change
`@@ -1589,8 +1589,8 @@ void action_web_request(struct mg_connection nc, struct http_message http_msg)`
`1589`	`1589`	`mg_send_head(nc, 200, strlen(GET_RTN_UNKNOWN), CONTENT_TEXT);`
`1590`	`1590`	`mg_send(nc, GET_RTN_UNKNOWN, strlen(GET_RTN_UNKNOWN));`
`1591`	`1591`	`}`
`1592`		`-`
`1593`		`- sprintf(buf, "action_web_request() request '%.*s' took",(int)http_msg->uri.len, http_msg->uri.p);`
	`1592`	`+ snprintf(buf, sizeof(buf), "action_web_request() request '%.*s' took",`
	`1593`	`+ (int)http_msg->uri.len, http_msg->uri.p);`
`1594`	`1594`
`1595`	`1595`	`DEBUG_TIMER_STOP(tid, NET_LOG, buf);`
`1596`	`1596`	`}`
`@@ -2171,4 +2171,4 @@ bool start_net_services(/struct mg_mgr mgr, /struct aqualinkdata aqdata)`
`2171`	`2171`	`return true;`
`2172`	`2172`	`}`
`2173`	`2173`
`2174`		`-#endif`
	`2174`	`+#endif`