Attachment 52256 Details for Bug 33431 – Fix buffer overflows in 0.8 codebase

[patch] Fix buffer overflows in 0.8 codebase

0001-Prevent-buffer-overflows-in-NMEA-parsing.patch (text/plain), 6.93 KB, created by Bastien Nocera on 2011-10-12 04:17:12 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Bastien Nocera

Created: 2011-10-12 04:17:12 UTC

Size: 6.93 KB

patch

obsolete

>From 03932804cd4b8e5a79c483fb05c82743f5ee93a2 Mon Sep 17 00:00:00 2001
>From: Bastien Nocera <hadess@hadess.net>
>Date: Wed, 12 Oct 2011 12:15:44 +0100
>Subject: [PATCH] Prevent buffer overflows in NMEA parsing
>
>By using snprintf() instead of sprintf.
>
>https://bugs.freedesktop.org/show_bug.cgi?id=33431
>---
> src/nmea-gen.c |   61 ++++++++++++++++++++++++++++---------------------------
> 1 files changed, 31 insertions(+), 30 deletions(-)
>
>diff --git a/src/nmea-gen.c b/src/nmea-gen.c
>index a8c2483..c52f925 100644
>--- a/src/nmea-gen.c
>+++ b/src/nmea-gen.c
>@@ -54,6 +54,7 @@
> #include "nmea-gen.h"
> 
> #define NMEA_BUF_SIZE		256
>+#define NMEASTC_BUF_SIZE	256
> #define NMEA_LATLON_SIZE	16
> #define NMEA_UTC_SIZE		16
> 
>@@ -121,7 +122,7 @@ void nmea_getutc(D800_Pvt_Data_Type *pvt, char *utctime, char *utcdate) {
> 		h = tmp / 3600;
> 		m = (tmp - h*3600) / 60;
> 		s = (tmp - h*3600 - m*60);
>-		sprintf(utctime, "%02d%02d%02d", h, m, s);
>+		snprintf(utctime, NMEA_UTC_SIZE, "%02d%02d%02d", h, m, s);
> 	}
> 
> 	if (utcdate) {
>@@ -149,7 +150,7 @@ void nmea_getutc(D800_Pvt_Data_Type *pvt, char *utctime, char *utcdate) {
> 
> 		year -= 2000;
> 
>-		sprintf(utcdate, "%02d%02d%02d", day, month, year);
>+		snprintf(utcdate, NMEA_UTC_SIZE, "%02d%02d%02d", day, month, year);
> 	}
> }
> 
>@@ -157,16 +158,16 @@ void nmea_fmtlat(double lat, char *latstr) {
> 	double	latdeg, tmp;
> 	latdeg = rad2deg(fabs(lat));
> 	tmp = floor(latdeg);
>-	sprintf(latstr, "%02d%07.4f,%c", (int)tmp, (latdeg - tmp) * 60,
>-		(lat >= 0) ? 'N' : 'S');
>+	snprintf(latstr, NMEA_LATLON_SIZE, "%02d%07.4f,%c", (int)tmp, (latdeg - tmp) * 60,
>+		 (lat >= 0) ? 'N' : 'S');
> }
> 
> void nmea_fmtlon(double lon, char *lonstr) {
> 	double	londeg, tmp;
> 	londeg = rad2deg(fabs(lon));
> 	tmp = floor(londeg);
>-	sprintf(lonstr, "%03d%07.4f,%c", (int)tmp, (londeg - tmp) * 60,
>-		(lon >= 0) ? 'E' : 'W');
>+	snprintf(lonstr, NMEA_LATLON_SIZE, "%03d%07.4f,%c", (int)tmp, (londeg - tmp) * 60,
>+		 (lon >= 0) ? 'E' : 'W');
> }
> 
> /*
>@@ -216,12 +217,12 @@ int nmea_gpgga(D800_Pvt_Data_Type *pvt, cpo_sat_data *sat, char *nmeastc) {
> 		}
> 	}
> 
>-	sprintf(buf, "GPGGA,%s,%s,%s,%d,%02d,,%.1f,M,%.1f,M,,", utc, slat, slon, fix, nsat,
>-		pvt->msl_hght + pvt->alt, -pvt->msl_hght);
>+	snprintf(buf, NMEA_BUF_SIZE, "GPGGA,%s,%s,%s,%d,%02d,,%.1f,M,%.1f,M,,", utc, slat, slon, fix, nsat,
>+		 pvt->msl_hght + pvt->alt, -pvt->msl_hght);
> 
> 	cksum = nmea_cksum(buf);
> 
>-	sprintf(nmeastc, "$%s*%02X\r\n", buf, cksum);
>+	snprintf(nmeastc, NMEASTC_BUF_SIZE, "$%s*%02X\r\n", buf, cksum);
> 
> 	return 0;
> }
>@@ -268,13 +269,13 @@ int nmea_gprmc(D800_Pvt_Data_Type *pvt, char *nmeastc) {
> 		g_lastcourse = course;	/* remember for later */
> 	}
> 
>-	sprintf(buf, "GPRMC,%s,%c,%s,%s,%05.1f,%05.1f,%s,,", utctime,
>-		(pvt->fix >= 2 && pvt->fix <= 5) ? 'A' : 'V',
>-		slat, slon, speed, course, utcdate);
>+	snprintf(buf, NMEA_BUF_SIZE, "GPRMC,%s,%c,%s,%s,%05.1f,%05.1f,%s,,", utctime,
>+		 (pvt->fix >= 2 && pvt->fix <= 5) ? 'A' : 'V',
>+		 slat, slon, speed, course, utcdate);
> 
> 	cksum = nmea_cksum(buf);
> 
>-	sprintf(nmeastc, "$%s*%02X\r\n", buf, cksum);
>+	snprintf(nmeastc, NMEASTC_BUF_SIZE, "$%s*%02X\r\n", buf, cksum);
> 
> 	return 0;
> }
>@@ -298,12 +299,12 @@ int nmea_gpgll(D800_Pvt_Data_Type *pvt, char *nmeastc) {
> 	/* longitude */
> 	nmea_fmtlon(pvt->lon, slon);
> 
>-	sprintf(buf, "GPGLL,%s,%s,%s,%c", slat, slon, utctime,
>-		(pvt->fix >= 2 && pvt->fix <= 5) ? 'A' : 'V');
>+	snprintf(buf, NMEA_BUF_SIZE, "GPGLL,%s,%s,%s,%c", slat, slon, utctime,
>+		 (pvt->fix >= 2 && pvt->fix <= 5) ? 'A' : 'V');
> 
> 	cksum = nmea_cksum(buf);
> 
>-	sprintf(nmeastc, "$%s*%02X\r\n", buf, cksum);
>+	snprintf(nmeastc, NMEASTC_BUF_SIZE, "$%s*%02X\r\n", buf, cksum);
> 
> 	return 0;
> }
>@@ -334,7 +335,7 @@ int nmea_gpgsa(D800_Pvt_Data_Type *pvt, cpo_sat_data *sat, char *nmeastc) {
> 		fprintf(stderr, "WARNING: unknown fix type %d\n", pvt->fix);
> 	}
> 
>-	sprintf(buf, "GPGSA,A,%d", fix);
>+	snprintf(buf, NMEA_BUF_SIZE, "GPGSA,A,%d", fix);
> 
> 	if (sat != NULL) {
> 		for (i = 0; i < SAT_MAX_COUNT; i++) {
>@@ -343,7 +344,7 @@ int nmea_gpgsa(D800_Pvt_Data_Type *pvt, cpo_sat_data *sat, char *nmeastc) {
> #ifdef DEBUG
> 				g_debug ("%s:     using sat %2d", __FUNCTION__, sat[i].svid);
> #endif
>-				sprintf(buf+strlen(buf), ",%02d", sat[i].svid);
>+				snprintf(buf+strlen(buf), NMEA_BUF_SIZE - strlen(buf), ",%02d", sat[i].svid);
> 				nsat++;
> 			}
> 			else
>@@ -362,10 +363,10 @@ int nmea_gpgsa(D800_Pvt_Data_Type *pvt, cpo_sat_data *sat, char *nmeastc) {
> 		strcat(buf, ",,,,,,,,,,,,");
> 	}
> 
>-	sprintf(buf+strlen(buf), ",,,");	// this should be DOP info
>+	snprintf(buf+strlen(buf), NMEA_BUF_SIZE - strlen(buf),",,,");	// this should be DOP info
> 
> 	cksum = nmea_cksum(buf);
>-	sprintf(nmeastc, "$%s*%02X\r\n", buf, cksum);
>+	snprintf(nmeastc, NMEASTC_BUF_SIZE, "$%s*%02X\r\n", buf, cksum);
> 
> 	return 0;
> }
>@@ -386,9 +387,9 @@ int nmea_gpgsv(cpo_sat_data *sat, char *nmeastc) {
> 	int		nsat, i, nout, msgi;
> 
> 	if (sat == NULL) {
>-		sprintf(buf, "GPGSV,1,1,00");
>+		snprintf(buf, NMEA_BUF_SIZE, "GPGSV,1,1,00");
> 		cksum = nmea_cksum(buf);
>-		sprintf(nmeastc, "$%s*%02X\r\n", buf, cksum);
>+		snprintf(nmeastc, NMEASTC_BUF_SIZE, "$%s*%02X\r\n", buf, cksum);
> 		return 0;
> 	}
> 
>@@ -417,15 +418,15 @@ int nmea_gpgsv(cpo_sat_data *sat, char *nmeastc) {
> 
> 	if (nsat == 0) {
> 		/* build a 'null' GPGSV string */
>-		sprintf(buf, "GPGSV,1,1,00");
>+		snprintf(buf, NMEA_BUF_SIZE, "GPGSV,1,1,00");
> 		cksum = nmea_cksum(buf);
>-		sprintf(nmeastc, "$%s*%02X\r\n", buf, cksum);
>+		snprintf(nmeastc, NMEASTC_BUF_SIZE, "$%s*%02X\r\n", buf, cksum);
> 	} else {
> 		/* scan the array again and build the GPGSV string(s) of active sats */
> 		nout = 0;
> 		msgi = 1;
> 		nmeastc[0] = 0;
>-		sprintf(buf, "GPGSV,%d,%d,%02d", (nsat-1)/4+1, msgi, nsat);
>+		snprintf(buf, NMEA_BUF_SIZE, "GPGSV,%d,%d,%02d", (nsat-1)/4+1, msgi, nsat);
> 		for (i = 0; i < SAT_MAX_COUNT; i++) {
> 			if (((sat[i].status & SAT_STATUS_MASK) == SAT_STATUS_GOOD) && (sat[i].svid <= MAX_SAT_SVID)) {
> 				int snr;
>@@ -435,24 +436,24 @@ int nmea_gpgsv(cpo_sat_data *sat, char *nmeastc) {
> //				else
> 					snr = sat[i].snr/100;	/* empirically, this seems to be the correct factor */
> 
>-				sprintf(buf+strlen(buf), ",%02d,%02d,%03d,%02d",
>-					sat[i].svid, sat[i].elev, sat[i].azmth, snr);
>+				snprintf(buf+strlen(buf), NMEA_BUF_SIZE - strlen(buf), ",%02d,%02d,%03d,%02d",
>+					 sat[i].svid, sat[i].elev, sat[i].azmth, snr);
> 				nout++;
> 
> 				/* if we have accumulated a group of 4 sats, write out the string */
> 				if (nout == 4) {
> 					cksum = nmea_cksum(buf);
>-					sprintf(nmeastc+strlen(nmeastc), "$%s*%02X\r\n", buf, cksum);
>+					snprintf(nmeastc+strlen(nmeastc), NMEASTC_BUF_SIZE - strlen(nmeastc), "$%s*%02X\r\n", buf, cksum);
> 					msgi++;
> 					nout = 0;
>-					sprintf(buf, "GPGSV,%d,%d,%02d", (nsat-1)/4+1, msgi, nsat);
>+					snprintf(buf, NMEA_BUF_SIZE, "GPGSV,%d,%d,%02d", (nsat-1)/4+1, msgi, nsat);
> 				}
> 			}
> 		}
> 
> 		if (nout != 0) {
> 			cksum = nmea_cksum(buf);
>-			sprintf(nmeastc+strlen(nmeastc), "$%s*%02X\r\n", buf, cksum);
>+			snprintf(nmeastc+strlen(nmeastc), NMEASTC_BUF_SIZE - strlen(nmeastc), "$%s*%02X\r\n", buf, cksum);
> 		}
> 	}
> 
>-- 
>1.7.6.2
>

Actions: View | Splinter Review

Attachments on bug 33431: 52255 | 52256

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.