From: Josh Oguin <josh.og...@oarcorp.com>
CodeSonar flagged this as a case where the user could inject a format
string and cause issues. Since we were not printing anything but a
string, just switching to puts() rather than fprintf(stdout,...) was
sufficient to make this code safer.
snprintf() places a limit on the length of the output from sprintf()
and avoids similar buffer overrun issues.
---
cpukit/libmisc/monitor/mon-editor.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
diff --git a/cpukit/libmisc/monitor/mon-editor.c
b/cpukit/libmisc/monitor/mon-editor.c
index 813c883..e7a3ae4 100644
--- a/cpukit/libmisc/monitor/mon-editor.c
+++ b/cpukit/libmisc/monitor/mon-editor.c
@@ -265,7 +265,7 @@ rtems_monitor_line_editor (
switch (c)
{
case KEYS_END:
- fprintf(stdout,buffer + pos);
+ puts(buffer + pos);
pos = (int) strlen (buffer);
break;
@@ -428,7 +428,7 @@ rtems_monitor_line_editor (
int ch, bs;
for (ch = end; ch > pos; ch--)
buffer[ch] = buffer[ch - 1];
- fprintf(stdout,buffer + pos);
+ puts(buffer + pos);
for (bs = 0; bs < (end - pos + 1); bs++)
putchar ('\b');
}
@@ -490,16 +490,18 @@ rtems_monitor_command_read(char *command,
*/
#if defined(RTEMS_MULTIPROCESSING)
if (!rtems_configuration_get_user_multiprocessing_table ())
- sprintf (monitor_prompt, "%s",
+ snprintf (monitor_prompt, sizeof(monitor_prompt), "%s",
(env_prompt == NULL) ? MONITOR_PROMPT: env_prompt);
else /* .... */
#endif
if (rtems_monitor_default_node != rtems_monitor_node)
- sprintf (monitor_prompt, "%" PRId32 "-%s-%" PRId32 "", rtems_monitor_node,
+ snprintf (monitor_prompt, sizeof(monitor_prompt),
+ "%" PRId32 "-%s-%" PRId32 "", rtems_monitor_node,
(env_prompt == NULL) ? MONITOR_PROMPT : env_prompt,
rtems_monitor_default_node);
else
- sprintf (monitor_prompt, "%" PRId32 "-%s", rtems_monitor_node,
+ snprintf (monitor_prompt, sizeof(monitor_prompt),
+ "%" PRId32 "-%s", rtems_monitor_node,
(env_prompt == NULL) ? MONITOR_PROMPT : env_prompt);
rtems_monitor_line_editor (command);
--
1.9.3
_______________________________________________
devel mailing list
devel@rtems.org
http://lists.rtems.org/mailman/listinfo/devel
