BiglyBT icon indicating copy to clipboard operation
BiglyBT copied to clipboard

Insufficient buffer size in C++ code causing debug builds to crash

Open eXl5eQ opened this issue 9 months ago • 1 comments

Here in aedevice.cpp

	char subkey[14];
	wsprintfA(subkey, "\\DosDevices\\%C:", driveLetter);

It's writing a 14-chars-long string "\DosDevices\X:" into a 14-chars-long buffer. However, wsprintfA appends a termincating null character to the string, so the buffer actually needs a capacity of at least 15 chars, otherwise it's a buffer overflow at runtime.

To be honest, it's not likely that it will cause any problem in real world. But an address sanitizer, which I often enabled in debug builds, will catch such out-of-bound access and crash the program.

eXl5eQ avatar May 10 '24 18:05 eXl5eQ