[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
[tor-bugs] #26522 [Core Tor/Tor]: strncat() without bounds
#26522: strncat() without bounds
------------------------------+------------------------------
Reporter: Dhiraj | Owner: (none)
Type: defect | Status: new
Priority: Medium | Milestone:
Component: Core Tor/Tor | Version: Tor: unspecified
Severity: Major | Keywords:
Actual Points: | Parent ID:
Points: | Reviewer:
Sponsor: |
------------------------------+------------------------------
Hi Team,
https://github.com/torproject/tor/blob/master/src/lib/err/backtrace.c#L267-L268
i.e
strncat(version, " ", sizeof(version)-1);
strncat(version, tor_version, sizeof(version)-1);
Easily used incorrectly (e.g., incorrectly computing the correct maximum
size to add) such as (CWE-120).
Consider strcat_s, strlcat, snprintf, or automatically resizing strings. I
feel the risk is high because the length parameter appears to be a
constant, instead of computing the number of characters left.
Request team to please have a look and validate.
Regards
Dhiraj
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/26522>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs