tslib icon indicating copy to clipboard operation
tslib copied to clipboard

ts_conf: Fix unbounded write by scanf()

Open szsam opened this issue 2 years ago • 0 comments

Buffer write operations that do not control the length of data written may overflow.

Also, the scanf format string "%[^\n]s" is ill-formed. It contains two independent format specifiers: "%[^\n]" followed by a lone "s". This will direct scanf to read everything until \n is encountered (leaving \n unread), and then require that the next input character is s. This just doesn't make any sense. No input will match such self-contradictory format. Reference: https://stackoverflow.com/questions/8177752/scanf-ns-a-vs-getsa

szsam avatar May 25 '23 03:05 szsam