From 7d4b15c0abe03f3fe8ffbdc302e7a56e15e5c4f2 Mon Sep 17 00:00:00 2001 From: Heikki Linnakangas Date: Tue, 30 Jul 2024 13:25:44 +0300 Subject: [PATCH v1 4/5] Replace static buf with a stack-allocated one in 'seg' extension The buffer is used only very locally within the function. Also, the initialization to '0' characters was unnecessary, the buffer was always overwritten to with sprintf(). I don't understand why it was done that way, but it's been like that since forever. In the passing, change from sprintf() to snprintf(). The buffer was long enough so sprintf() was fine, but this makes it more obvious that there's no risk of buffer overflow.x --- contrib/seg/segparse.y | 14 ++++---------- 1 file changed, 4 insertions(+), 10 deletions(-) diff --git a/contrib/seg/segparse.y b/contrib/seg/segparse.y index 729d4b6390b..9635c3af6e6 100644 --- a/contrib/seg/segparse.y +++ b/contrib/seg/segparse.y @@ -29,14 +29,6 @@ static bool seg_atof(char *value, float *result, struct Node *escontext); static int sig_digits(const char *value); -static char strbuf[25] = { - '0', '0', '0', '0', '0', - '0', '0', '0', '0', '0', - '0', '0', '0', '0', '0', - '0', '0', '0', '0', '0', - '0', '0', '0', '0', '\0' -}; - %} /* BISON Declarations */ @@ -69,11 +61,13 @@ static char strbuf[25] = { range: boundary PLUMIN deviation { + char strbuf[25]; + result->lower = $1.val - $3.val; result->upper = $1.val + $3.val; - sprintf(strbuf, "%g", result->lower); + snprintf(strbuf, sizeof(strbuf), "%g", result->lower); result->l_sigd = Max(sig_digits(strbuf), Max($1.sigd, $3.sigd)); - sprintf(strbuf, "%g", result->upper); + snprintf(strbuf, sizeof(strbuf), "%g", result->upper); result->u_sigd = Max(sig_digits(strbuf), Max($1.sigd, $3.sigd)); result->l_ext = '\0'; result->u_ext = '\0'; -- 2.39.2