From aaca6af87fffdee45529af3dc444d5733916e1a1 Mon Sep 17 00:00:00 2001 From: Kevin Day Date: Wed, 8 May 2024 20:51:11 -0500 Subject: [PATCH] Security: Potential buffer overflow on 0 length array. The length_name_item variable can potentially be zero. The assignment of "name_item[length_name_item] = 0;" will then result in an assignment on a 0 length array. This issue has been exposed via GCC's -fanalyzer. --- sources/c/main/rule/setting.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sources/c/main/rule/setting.c b/sources/c/main/rule/setting.c index d7086a0..a717c8d 100644 --- a/sources/c/main/rule/setting.c +++ b/sources/c/main/rule/setting.c @@ -40,7 +40,7 @@ extern "C" { const f_number_unsigned_t line_item = cache->action.line_item; const f_number_unsigned_t length_name_item = cache->action.name_item.used; - f_char_t name_item[length_name_item]; + f_char_t name_item[length_name_item + 1]; name_item[length_name_item] = 0; memcpy(name_item, cache->action.name_item.string, sizeof(f_char_t) * length_name_item); -- 1.8.3.1