From aaca6af87fffdee45529af3dc444d5733916e1a1 Mon Sep 17 00:00:00 2001
From: Kevin Day <kevin@kevux.org>
Date: Wed, 8 May 2024 20:51:11 -0500
Subject: [PATCH] Security: Potential buffer overflow on 0 length array.
The length_name_item variable can potentially be zero.
The assignment of "name_item[length_name_item] = 0;" will then result in an assignment on a 0 length array.
This issue has been exposed via GCC's -fanalyzer.
---
sources/c/main/rule/setting.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sources/c/main/rule/setting.c b/sources/c/main/rule/setting.c
index d7086a0..a717c8d 100644
--- a/sources/c/main/rule/setting.c
+++ b/sources/c/main/rule/setting.c
@@ -40,7 +40,7 @@ extern "C" {
const f_number_unsigned_t line_item = cache->action.line_item;
const f_number_unsigned_t length_name_item = cache->action.name_item.used;
- f_char_t name_item[length_name_item];
+ f_char_t name_item[length_name_item + 1];
name_item[length_name_item] = 0;
memcpy(name_item, cache->action.name_item.string, sizeof(f_char_t) * length_name_item);
--
1.8.3.1