RTOS/rtems
1
0
Fork 0
forked from Imagelibrary/rtems
Code Pull Requests Activity

monitor/mon-editor.c: Use puts() and snprintf() not fprintf() or sprintf()

Browse Source 
CodeSonar flagged this as a case where the user could inject a format
string and cause issues. Since we were not printing anything but a
string, just switching to puts() rather than fprintf(stdout,...) was
sufficient to make this code safer.

snprintf() places a limit on the length of the output from sprintf()
and avoids similar buffer overrun issues.
This commit is contained in:
Josh Oguin
2014-11-19 14:42:02 -06:00
committed by Joel Sherrill
parent 4862532fd9
commit 90a8e42be4
1 changed files with 7 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
cpukit/libmisc/monitor/mon-editor.c
View File

@@ -265,7 +265,7 @@ rtems_monitor_line_editor (
switch (c)
{
case KEYS_END:
fprintf(stdout,buffer + pos);
puts(buffer + pos);
pos = (int) strlen (buffer);
break;
@@ -428,7 +428,7 @@ rtems_monitor_line_editor (
int ch, bs;
for (ch = end; ch > pos; ch--)
buffer[ch] = buffer[ch - 1];
fprintf(stdout,buffer + pos);
puts(buffer + pos);
for (bs = 0; bs < (end - pos + 1); bs++)
putchar ('\b');
}
@@ -490,16 +490,18 @@ rtems_monitor_command_read(char *command,
*/
#if defined(RTEMS_MULTIPROCESSING)
if (!rtems_configuration_get_user_multiprocessing_table ())
sprintf (monitor_prompt, "%s",
snprintf (monitor_prompt, sizeof(monitor_prompt), "%s",
(env_prompt == NULL) ? MONITOR_PROMPT: env_prompt);
else /* .... */
#endif
if (rtems_monitor_default_node != rtems_monitor_node)
sprintf (monitor_prompt, "%" PRId32 "-%s-%" PRId32 "", rtems_monitor_node,
snprintf (monitor_prompt, sizeof(monitor_prompt),
"%" PRId32 "-%s-%" PRId32 "", rtems_monitor_node,
(env_prompt == NULL) ? MONITOR_PROMPT : env_prompt,
rtems_monitor_default_node);
else
sprintf (monitor_prompt, "%" PRId32 "-%s", rtems_monitor_node,
snprintf (monitor_prompt, sizeof(monitor_prompt),
"%" PRId32 "-%s", rtems_monitor_node,
(env_prompt == NULL) ? MONITOR_PROMPT : env_prompt);
rtems_monitor_line_editor (command);