From 6b91892bb657224f55a013213d5df77e37726c0b Mon Sep 17 00:00:00 2001 From: lincuiping <57204139+lincuiping@users.noreply.github.com> Date: Thu, 7 Apr 2022 17:47:18 +0800 Subject: [PATCH] Fix sscanf limits. Make sure that the string parsing is limited by the size of the destination buffer. --- dir.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/dir.c b/dir.c index 5861f610..49fa4761 100644 --- a/dir.c +++ b/dir.c @@ -7,6 +7,7 @@ *------------------------------------------------------------------------- */ +#include "c.h" #include "pg_rman.h" #include @@ -559,7 +560,7 @@ dir_read_file_list(const char *root, const char *file_txt) while (fgets(buf, lengthof(buf), fp)) { - char path[MAXPGPATH]; + char path[MAXPGPATH + 1]; char type; unsigned long write_size; pg_crc32c crc; @@ -568,7 +569,7 @@ dir_read_file_list(const char *root, const char *file_txt) pgFile *file; memset(&tm, 0, sizeof(tm)); - if (sscanf(buf, "%s %c %lu %u %o %d-%d-%d %d:%d:%d", + if (sscanf(buf, "%" CppAsString2(MAXPGPATH) "s %c %lu %u %o %d-%d-%d %d:%d:%d", path, &type, &write_size, &crc, &mode, &tm.tm_year, &tm.tm_mon, &tm.tm_mday, &tm.tm_hour, &tm.tm_min, &tm.tm_sec) != 11)