Giters

weggli-rs / weggli

weggli is a fast and robust semantic search tool for C and C++ codebases. It is designed to help security researchers identify interesting functionality in large codebases.

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

what is the vuln of "snprintf"?

leveryd opened this issue · comments

commented

i am confused about the query on doucment "README.md"

    $ret = snprintf($b,_,_);
    $b[$ret] = _;

this query represent what vulnerable code?

commented

Hey,

The functions snprintf() and vsnprintf() do not write more than size bytes (including the terminating null byte ('\0')). If the output was truncated due to this limit then the return value is the number of characters (excluding the terminating null byte) which would have been written to the final string if enough space had been available. Thus, a return value of size or more means that the output was truncated. (See also below under NOTES.)
(see https://linux.die.net/man/3/snprintf)

so $ret can be larger than the size of the destination buffer ($b), which makes $b[$ret] a potential out-of-bounds access.