3 ms·
https://github.com/doches/progressbar/blob/master/lib/progressbar.c#L28:L30 https://github.com/doches/progressbar/blob/master/lib/progre... The correct solutio
by _RPM 11y ago
https://github.com/doches/progressbar/blob/master/lib/progressbar.c#L28:L30 https://github.com/doches/progressbar/blob/master/lib/progre...
The correct solution would be a) check the length of format, and if it less than or equal to 4 but greater than 0, then copy the bytes, else, don't... I guess? Why is 4 such an arbitrary chosen number?
// new->format is allocated to 4 bytes
size_t len = strlen(format);
if(len > 0 && len <= 4) {
memcpy(new->format, format, len); //i to < 4
new->format[3] = '\0';
}
Or it just be better to allocate the new->length to the return value of strlen(format) + 1.
- danieldk 11y agoMaybe I am not awake yet (just rolled out of bed), but if new->format is allocated to 4 bytes, then new->format[4] = '\0'; is out of bounds, no?
- _RPM 11y agoYes it was. Good catch. The size of the buffer is 4, so the last byte would be located at 4-1 = index 3. Because we're 0 based...Wow can't believe I did that. it's 12:30 AM here and I've had a few beers tonight. It's common to allocate your size needed plus 1 for the NULL byte. But this programmer only allocates 4 bytes.. with no thought of the NULL byte at the end.