From 2b5c1b4b133a97a46354142aa8ab0d9e79bc70a4 Mon Sep 17 00:00:00 2001 From: Tomasz Kramkowski Date: Thu, 29 Dec 2016 19:42:41 +0100 Subject: Replace all uses of sprintf with snprintf In all the cases where sprintf was being used within htop, snprintf could have been used. This patch replaces all uses of sprintf with snprintf which makes sure that if a buffer is too small to hold the resulting string, the string is simply cut short instead of causing a buffer overflow which leads to undefined behaviour. `sizeof(variable)` was used in these cases, as opposed to `sizeof variable` which is my personal preference because `sizeof(variable)` was already used in one way or another in other parts of the code. --- TraceScreen.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'TraceScreen.c') diff --git a/TraceScreen.c b/TraceScreen.c index 2d6eb336..bd771182 100644 --- a/TraceScreen.c +++ b/TraceScreen.c @@ -99,7 +99,7 @@ bool TraceScreen_forkTracer(TraceScreen* this) { dup2(this->fdpair[1], STDERR_FILENO); int ok = fcntl(this->fdpair[1], F_SETFL, O_NONBLOCK); if (ok != -1) { - sprintf(buffer, "%d", this->super.process->pid); + snprintf(buffer, sizeof(buffer), "%d", this->super.process->pid); execlp("strace", "strace", "-p", buffer, NULL); } const char* message = "Could not execute 'strace'. Please make sure it is available in your $PATH."; -- cgit v1.2.3