Changeset 1213

Timestamp:

04/07/23 18:39:27 (13 months ago)

Author:

Maciej Komosinski

Message:

Fixed buffer overflow - the [...] pattern in scanf() always stores the trailing \0 in addition to the characters matched

File:

• cpp/frams/genetics/f4/f4_general.cpp (modified) (4 diffs)

cpp/frams/genetics/f4/f4_general.cpp

@@ -1 +1 @@
 // This file is a part of Framsticks SDK.  http://www.framsticks.com/
-// Copyright (C) 1999-2020  Maciej Komosinski and Szymon Ulatowski.
+// Copyright (C) 1999-2023  Maciej Komosinski and Szymon Ulatowski.
 // See LICENSE.txt for details.
 
@@ -1355 +1355 @@
 {
         int i, j, res, t;
-        char tc1, tc2, tc3; // tc3 is only to ensure that neuron parameter definition is completed
+        char tc1, tc2, tc3[2]; // tc3 is only to ensure that neuron parameter definition is completed
         int relfrom;
         double w;
@@ -1485 +1485 @@
                         }
                         // if there is a colon determining neuron parameter, then let the switch case colon handle this
-                        else if (sscanf(genot + gpos + 1, ":%c%c%[:]", &tc1, &tc2, &tc3) == 3)
+                        else if (sscanf(genot + gpos + 1, ":%c%c%1[:]", &tc1, &tc2, &tc3) == 3)
                         {
                                 node1 = new f4_node(genot[gpos], par, gpos);
@@ -1506 +1506 @@
                 {
                         // neuron parameter  +! -! += -= +/ or -/
-                        if (sscanf(genot + gpos, ":%c%c%[:]", &tc1, &tc2, &tc3) != 3)
+                        if (sscanf(genot + gpos, ":%c%c%1[:]", &tc1, &tc2, &tc3) != 3)
                                 // error: incorrect format
                                 return gpos + 1 + 1;