KiTTY icon indicating copy to clipboard operation
KiTTY copied to clipboard

kitty.c buffer overflow

Open Devon7 opened this issue 3 years ago • 0 comments

kitty.c buffer overflow - suggest title[1024 + 15] assuming GetWindowText promises to end with a NUL.

int ManageLocalCmd( HWND hwnd, const char * cmd ) {
	char buffer[1024] = "", title[1024] = "" ;
⋮
	} else if( (cmd[0]=='t')&&(cmd[1]=='i')&&(cmd[2]=='\0') ) { // __ti: Recuperation du titre de la fenetres
		GetWindowText( hwnd, buffer, 1024 ) ;
		sprintf( title, "printf \"\\033]0;%s\\007\"\n", buffer ) ;
		SendStrToTerminal( title, strlen(title) ) ;
		return 1 ;

bash$

(cd /tmp && cc -xc - && (./a.out; echo \$? = $?)) <<.
#include <stdio.h>
#include <string.h>
int main () {
  char buffer[1024] = "", title[1024] = "" ;
  sprintf( title, "printf \"\\033]0;%s\\007\"\n", buffer ) ;
  return strlen( title ) ;
}
.

$? = 15

Devon7 avatar Aug 13 '22 19:08 Devon7