From c9fbcd88181a61d62cd9c53cb3672ca45700b220 Mon Sep 17 00:00:00 2001 From: Mingjie Shen Date: Thu, 20 Apr 2023 22:48:04 -0400 Subject: Fix potential buffer overflows when calling sprintf 1. Replace sprintf with snprintf, which is safer 2. An unsigned int or unsigned long int requires 11 bytes to print (including the null terminator) 3. Use PRIu16 macro to print uint16_t 4. Format string "#%2d %2d:%02d:%02d.%02d\n" in StopWatch::stopLapBtnEventHandler() requires at least 17 bytes. The 16-byte buffer would clearly be overrun if sprintf were used. --- src/displayapp/screens/SystemInfo.cpp | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) (limited to 'src/displayapp/screens/SystemInfo.cpp') diff --git a/src/displayapp/screens/SystemInfo.cpp b/src/displayapp/screens/SystemInfo.cpp index eea75938..18fb7ad2 100644 --- a/src/displayapp/screens/SystemInfo.cpp +++ b/src/displayapp/screens/SystemInfo.cpp @@ -236,9 +236,9 @@ std::unique_ptr SystemInfo::CreateScreen4() { auto nb = uxTaskGetSystemState(tasksStatus, maxTaskCount, nullptr); std::sort(tasksStatus, tasksStatus + nb, sortById); for (uint8_t i = 0; i < nb && i < maxTaskCount; i++) { - char buffer[7] = {0}; + char buffer[11] = {0}; - sprintf(buffer, "%lu", tasksStatus[i].xTaskNumber); + snprintf(buffer, sizeof(buffer), "%lu", tasksStatus[i].xTaskNumber); lv_table_set_cell_value(infoTask, i + 1, 0, buffer); switch (tasksStatus[i].eCurrentState) { case eReady: @@ -262,9 +262,9 @@ std::unique_ptr SystemInfo::CreateScreen4() { lv_table_set_cell_value(infoTask, i + 1, 1, buffer); lv_table_set_cell_value(infoTask, i + 1, 2, tasksStatus[i].pcTaskName); if (tasksStatus[i].usStackHighWaterMark < 20) { - sprintf(buffer, "%d low", tasksStatus[i].usStackHighWaterMark); + snprintf(buffer, sizeof(buffer), "%" PRIu16 " low", tasksStatus[i].usStackHighWaterMark); } else { - sprintf(buffer, "%d", tasksStatus[i].usStackHighWaterMark); + snprintf(buffer, sizeof(buffer), "%" PRIu16, tasksStatus[i].usStackHighWaterMark); } lv_table_set_cell_value(infoTask, i + 1, 3, buffer); } -- cgit v1.2.3-70-g09d2