cisco/joy

no limitation for "%s" while calling fscanf()

QiAnXinCodeSafe opened this issue · 1 comments

rc = fscanf(ps_file,"%lu %s\n",&ps_pid,dummy_string);

dummy_string defined here:

char dummy_string[PID_MAX_LEN];

macro PID_MAX_LEN defined here:

#define PID_MAX_LEN 64

no limitation for "%s" while calling fscanf() may cause overwrite.

    rc = fscanf(ps_file,"%lu %64s\n",&ps_pid,dummy_string);

rc = fscanf(ss_file,"%s %d %d %s %s %s\n", dummy_string,&dummy_int,&dummy_int,src_string,dst_string,pid_string);