From 03e67f2e3a3e87fbbe286d5a67085015e6007329 Mon Sep 17 00:00:00 2001 From: Jeremy Sowden Date: Tue, 30 Nov 2021 10:55:46 +0000 Subject: output: SQLITE3: fix possible buffer overruns There is a an off-by-one error in the size of some of the buffers used to hold key-names. The maximum length of a name is `ULOGD_MAX_KEYLEN`, and so declare the buffers with size `ULOGD_MAX_KEYLEN + 1`. Signed-off-by: Jeremy Sowden Signed-off-by: Pablo Neira Ayuso --- output/sqlite3/ulogd_output_SQLITE3.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'output') diff --git a/output/sqlite3/ulogd_output_SQLITE3.c b/output/sqlite3/ulogd_output_SQLITE3.c index 20ceb3b..554b1b3 100644 --- a/output/sqlite3/ulogd_output_SQLITE3.c +++ b/output/sqlite3/ulogd_output_SQLITE3.c @@ -48,7 +48,7 @@ struct field { TAILQ_ENTRY(field) link; - char name[ULOGD_MAX_KEYLEN]; + char name[ULOGD_MAX_KEYLEN + 1]; struct ulogd_key *key; }; @@ -214,7 +214,7 @@ sqlite3_createstmt(struct ulogd_pluginstance *pi) { struct sqlite3_priv *priv = (void *)pi->private; struct field *f; - char buf[ULOGD_MAX_KEYLEN]; + char buf[ULOGD_MAX_KEYLEN + 1]; char *underscore; char *stmt_pos; int i, cols = 0; @@ -305,7 +305,7 @@ static int sqlite3_init_db(struct ulogd_pluginstance *pi) { struct sqlite3_priv *priv = (void *)pi->private; - char buf[ULOGD_MAX_KEYLEN]; + char buf[ULOGD_MAX_KEYLEN + 1]; char *underscore; struct field *f; sqlite3_stmt *schema_stmt; -- cgit v1.2.3