mmr/Livox-SDK
Archived
1
0
Fork 0
Code Issues 105 Pull Requests 11 Actions Packages Projects Releases 9 Wiki Activity

fix: strncpy reads out of bounds #52

Merged
SirDifferential merged 1 commits from strncpy_oob_fix into master 2020-06-08 12:36:05 +02:00
Conversation 1 Commits 1 Files Changed 2
+3 -3
SirDifferential commented 2020-05-18 08:03:18 +02:00 (Migrated from github.com)
Copy Link
Copy Source

There are several out of bounds strncpy calls. This commit fixes them. On gcc 8.3.0 the SDK does not compile without this fix and gives the error:

/home/gekko/Livox-SDK/sdk_core/src/device_manager.cpp: In member function ‘bool livox::DeviceManager::AddListeningDevice(const string&, livox::DeviceM
ode, uint8_t&)’:                                                                                                                                      
/home/gekko/Livox-SDK/sdk_core/src/device_manager.cpp:177:14: error: ‘char* strncpy(char*, const char*, size_t)’ specified bound 16 equals destination
 size [-Werror=stringop-truncation]                                                                                                                   
       strncpy(ite->info.broadcast_code, broadcast_code.c_str(), sizeof(ite->info.broadcast_code));                                              
       ~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~                                                    
/home/gekko/Livox-SDK/sdk_core/src/device_manager.cpp:166:12: error: ‘char* strncpy(char*, const char*, size_t)’ specified bound 16 equals destination
 size [-Werror=stringop-truncation]                                                                       
     strncpy(devices_[kHubDefaultHandle].info.broadcast_code,                               
     ~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~                                                                                    
             broadcast_code.c_str(),                                                                                                                 
             ~~~~~~~~~~~~~~~~~~~~~~~                                                                                                                 
             sizeof(devices_[kHubDefaultHandle].info.broadcast_code));                                                                                
             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

among other errors of similar nature.

There are a few similar cases elsewhere, although they only produce warnings. I didn't investigate them in detail, but here are the warnings:

/home/gekko/Livox-SDK/sample/lidar/main.c:273:7: warning: ‘strncpy’ specified bound depends on the length of the source argument [-Wstringop-overflow=
]
       strncpy(sn_list, optarg, sizeof(char)*(strlen(optarg) + 1));
       ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/home/gekko/Livox-SDK/sample/lidar/main.c:273:46: note: length computed here
       strncpy(sn_list, optarg, sizeof(char)*(strlen(optarg) + 1));
                                              ^~~~~~~~~~~~~~

/home/gekko/Livox-SDK/sample/lidar_lvx_file/main.cpp: In function ‘int SetProgramOption(int, const char**)’:                                         
/home/gekko/Livox-SDK/sample/lidar_lvx_file/main.cpp:324:14: warning: ‘char* strncpy(char*, const char*, size_t)’ specified bound depends on the lengt
h of the source argument [-Wstringop-overflow=]
       strncpy(sn_list, optarg, sizeof(char)*(strlen(optarg) + 1));
       ~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/home/gekko/Livox-SDK/sample/lidar_lvx_file/main.cpp:324:52: note: length computed here                                                              
       strncpy(sn_list, optarg, sizeof(char)*(strlen(optarg) + 1));
                                              ~~~~~~^~~~~~~~
In function ‘int SetProgramOption(int, const char**)’,
    inlined from ‘int main(int, const char**)’ at /home/gekko/Livox-SDK/sample_cc/lidar/main.cpp:127:23:
/home/gekko/Livox-SDK/sample_cc/lidar/main.cpp:80:16: warning: ‘char* strncpy(char*, const char*, size_t)’ specified bound depends on the length of th
e source argument [-Wstringop-overflow=]
         strncpy(sn_list, optarg, sizeof(char)*(strlen(optarg) + 1));
         ~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/home/gekko/Livox-SDK/sample_cc/lidar/main.cpp: In function ‘int main(int, const char**)’:
/home/gekko/Livox-SDK/sample_cc/lidar/main.cpp:80:54: note: length computed here
         strncpy(sn_list, optarg, sizeof(char)*(strlen(optarg) + 1));
                                                ~~~~~~^~~~~~~~
In function ‘int SetProgramOption(int, const char**)’,
    inlined from ‘int main(int, const char**)’ at /home/gekko/Livox-SDK/sample_cc/lidar_utc_sync/main.cpp:129:23:                                    
/home/gekko/Livox-SDK/sample_cc/lidar_utc_sync/main.cpp:82:16: warning: ‘char* strncpy(char*, const char*, size_t)’ specified bound depends on the length of the source argument [-Wstringop-overflow=]
         strncpy(sn_list, optarg, sizeof(char)*(strlen(optarg) + 1));
         ~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/home/gekko/Livox-SDK/sample_cc/lidar_utc_sync/main.cpp: In function ‘int main(int, const char**)’:                                                  
/home/gekko/Livox-SDK/sample_cc/lidar_utc_sync/main.cpp:82:54: note: length computed here                                                            
         strncpy(sn_list, optarg, sizeof(char)*(strlen(optarg) + 1));
                                                ~~~~~~^~~~~~~~
There are several out of bounds strncpy calls. This commit fixes them. On gcc 8.3.0 the SDK does not compile without this fix and gives the error: ``` /home/gekko/Livox-SDK/sdk_core/src/device_manager.cpp: In member function ‘bool livox::DeviceManager::AddListeningDevice(const string&, livox::DeviceM ode, uint8_t&)’: /home/gekko/Livox-SDK/sdk_core/src/device_manager.cpp:177:14: error: ‘char* strncpy(char*, const char*, size_t)’ specified bound 16 equals destination size [-Werror=stringop-truncation] strncpy(ite->info.broadcast_code, broadcast_code.c_str(), sizeof(ite->info.broadcast_code)); ~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ /home/gekko/Livox-SDK/sdk_core/src/device_manager.cpp:166:12: error: ‘char* strncpy(char*, const char*, size_t)’ specified bound 16 equals destination size [-Werror=stringop-truncation] strncpy(devices_[kHubDefaultHandle].info.broadcast_code, ~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ broadcast_code.c_str(), ~~~~~~~~~~~~~~~~~~~~~~~ sizeof(devices_[kHubDefaultHandle].info.broadcast_code)); ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ``` among other errors of similar nature. There are a few similar cases elsewhere, although they only produce warnings. I didn't investigate them in detail, but here are the warnings: ``` /home/gekko/Livox-SDK/sample/lidar/main.c:273:7: warning: ‘strncpy’ specified bound depends on the length of the source argument [-Wstringop-overflow= ] strncpy(sn_list, optarg, sizeof(char)*(strlen(optarg) + 1)); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ /home/gekko/Livox-SDK/sample/lidar/main.c:273:46: note: length computed here strncpy(sn_list, optarg, sizeof(char)*(strlen(optarg) + 1)); ^~~~~~~~~~~~~~ /home/gekko/Livox-SDK/sample/lidar_lvx_file/main.cpp: In function ‘int SetProgramOption(int, const char**)’: /home/gekko/Livox-SDK/sample/lidar_lvx_file/main.cpp:324:14: warning: ‘char* strncpy(char*, const char*, size_t)’ specified bound depends on the lengt h of the source argument [-Wstringop-overflow=] strncpy(sn_list, optarg, sizeof(char)*(strlen(optarg) + 1)); ~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ /home/gekko/Livox-SDK/sample/lidar_lvx_file/main.cpp:324:52: note: length computed here strncpy(sn_list, optarg, sizeof(char)*(strlen(optarg) + 1)); ~~~~~~^~~~~~~~ In function ‘int SetProgramOption(int, const char**)’, inlined from ‘int main(int, const char**)’ at /home/gekko/Livox-SDK/sample_cc/lidar/main.cpp:127:23: /home/gekko/Livox-SDK/sample_cc/lidar/main.cpp:80:16: warning: ‘char* strncpy(char*, const char*, size_t)’ specified bound depends on the length of th e source argument [-Wstringop-overflow=] strncpy(sn_list, optarg, sizeof(char)*(strlen(optarg) + 1)); ~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ /home/gekko/Livox-SDK/sample_cc/lidar/main.cpp: In function ‘int main(int, const char**)’: /home/gekko/Livox-SDK/sample_cc/lidar/main.cpp:80:54: note: length computed here strncpy(sn_list, optarg, sizeof(char)*(strlen(optarg) + 1)); ~~~~~~^~~~~~~~ In function ‘int SetProgramOption(int, const char**)’, inlined from ‘int main(int, const char**)’ at /home/gekko/Livox-SDK/sample_cc/lidar_utc_sync/main.cpp:129:23: /home/gekko/Livox-SDK/sample_cc/lidar_utc_sync/main.cpp:82:16: warning: ‘char* strncpy(char*, const char*, size_t)’ specified bound depends on the length of the source argument [-Wstringop-overflow=] strncpy(sn_list, optarg, sizeof(char)*(strlen(optarg) + 1)); ~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ /home/gekko/Livox-SDK/sample_cc/lidar_utc_sync/main.cpp: In function ‘int main(int, const char**)’: /home/gekko/Livox-SDK/sample_cc/lidar_utc_sync/main.cpp:82:54: note: length computed here strncpy(sn_list, optarg, sizeof(char)*(strlen(optarg) + 1)); ~~~~~~^~~~~~~~ ```
Livox-SDK (Migrated from github.com) approved these changes 2020-06-08 12:35:51 +02:00
This repo is archived. You cannot comment on pull requests.
Reviewers
No Reviewers
Livox-SDK
Labels
Clear labels
bug
Something isn't working
 duplicate
This issue or pull request already exists
 enhancement
New feature or request
 good first issue
Good for newcomers
 help wanted
Extra attention is needed
 invalid
This doesn't seem right
 question
Further information is requested
 wontfix
This will not be worked on
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
eeeck (Erick)
No Assignees
1 Participants
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mmr/Livox-SDK#52
Delete Branch "strncpy_oob_fix"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?