PenTest/nmap
1
0
Fork 0
mirror of https://github.com/nmap/nmap.git synced 2025-12-12 02:39:03 +00:00
Code Issues Projects Releases Wiki Activity

Corrects a few issues related to snprintf return values

Browse Source
This commit is contained in:
nnposter
2018-08-26 02:29:14 +00:00
parent d22dbc63b8
commit 973b471c11
4 changed files with 10 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
NmapOutputTable.cc
View File

@@ -233,7 +233,7 @@ void NmapOutputTable::addItemFormatted(unsigned int row,
res = Vsnprintf(buf, sizeof(buf), fmt, ap); res = Vsnprintf(buf, sizeof(buf), fmt, ap);
va_end(ap); va_end(ap);
if (res > sizeof(buf)) if (res >= sizeof(buf))
fatal("NmapOutputTable only supports adding up to 4096 to a cell via %s.", __func__); fatal("NmapOutputTable only supports adding up to 4096 to a cell via %s.", __func__);
addItem(row, column, fullrow, true, buf, res); addItem(row, column, fullrow, true, buf, res);

2
nbase/nbase_str.c
View File

@@ -196,7 +196,7 @@ int Vsnprintf(char *s, size_t n, const char *fmt, va_list ap) {
ret = vsnprintf(s, n, fmt, ap); ret = vsnprintf(s, n, fmt, ap);
if (ret < 0 || (unsigned)ret >= n) if (ret < 0 || (unsigned)ret >= n)
s[n - 1] = '\0'; s[n - 1] = '\0'; /* technically redundant */
return ret; return ret;
} }

12
nsock/src/nsock_write.c
View File

@@ -170,6 +170,7 @@ nsock_event_id nsock_printf(nsock_pool ms_pool, nsock_iod ms_iod,
struct nevent *nse; struct nevent *nse;
char buf[4096]; char buf[4096];
char *buf2 = NULL; char *buf2 = NULL;
size_t buf2size;
int res, res2; int res, res2;
int strlength = 0; int strlength = 0;
char displaystr[256]; char displaystr[256];
@@ -183,13 +184,14 @@ nsock_event_id nsock_printf(nsock_pool ms_pool, nsock_iod ms_iod,
res = Vsnprintf(buf, sizeof(buf), format, ap); res = Vsnprintf(buf, sizeof(buf), format, ap);
va_end(ap); va_end(ap);
if (res != -1) { if (res >= 0) {
if (res > sizeof(buf)) { if (res >= sizeof(buf)) {
buf2 = (char * )safe_malloc(res + 16); buf2size = res + 16;
buf2 = (char * )safe_malloc(buf2size);
va_start(ap,format); va_start(ap,format);
res2 = Vsnprintf(buf2, sizeof(buf), format, ap); res2 = Vsnprintf(buf2, buf2size, format, ap);
va_end(ap); va_end(ap);
if (res2 == -1 || res2 > res) { if (res2 < 0 || res2 >= buf2size) {
free(buf2); free(buf2);
buf2 = NULL; buf2 = NULL;
} else } else

2
service_scan.cc
View File

@@ -896,7 +896,7 @@ static char *substvar(char *tmplvar, char **tmplvarend,
} }
} }
buflen = Snprintf(buf, sizeof(buf), "%lu", val); buflen = Snprintf(buf, sizeof(buf), "%lu", val);
if (buflen < 0 || buflen > (int) sizeof(buf)) { if (buflen < 0 || buflen >= (int) sizeof(buf)) {
return NULL; return NULL;
} }
strbuf_append(&result, &n, &len, buf, buflen); strbuf_append(&result, &n, &len, buf, buflen);