Security: Potential buffer overflow on 0 length array.

The length_name_item variable can potentially be zero.
The assignment of "name_item[length_name_item] = 0;" will then result in an assignment on a 0 length array.

This issue has been exposed via GCC's -fanalyzer.

diff --git a/level_3/controller/c/rule/private-rule.c b/level_3/controller/c/rule/private-rule.c
index a0c242861676313621a02558be955236f954d4ab..94829cd5a3233232d43a9fcfca7af144cfb0ab4f 100644 (file)
--- a/level_3/controller/c/rule/private-rule.c
+++ b/level_3/controller/c/rule/private-rule.c
@@ -3971,7 +3971,7 @@ extern "C" {
     const f_array_length_t line_item = cache->action.line_item;
     const f_array_length_t length_name_item = cache->action.name_item.used;
 
-    f_char_t name_item[length_name_item];
+    f_char_t name_item[length_name_item + 1];
     name_item[length_name_item] = 0;
 
     memcpy(name_item, cache->action.name_item.string, sizeof(f_char_t) * length_name_item);