Skip to content

Stack Buffer Overflow in nastran-g.c when processing large PBAR/PSHELL PIDs #211

@THE-Amrit-mahto-05

Description

@THE-Amrit-mahto-05

Bug Type: Security / Buffer Overflow / Crash

Description:
In src/conv/nastran-g.c, the PBAR and PSHELL conversion loops use sprintf to write group names into a fixed-size stack buffer:

char name[NAMESIZE+1];  // 17 bytes
sprintf(name, "pbar_group.%d", pbp->pid);
sprintf(name, "pshell.%d", psh->pid);

If the PID has more than 6 digits (or 10 digits for 32-bit max int), the resulting string exceeds the buffer size, causing a stack buffer overflow. This can crash nastran-g and theoretically allow code execution.

Proposed Fix:

Increase the buffer size to 32 bytes:

char name[32];

Use snprintf instead of sprintf:

snprintf(name, sizeof(name), "pbar_group.%d", pbp->pid);
snprintf(name, sizeof(name), "pshell.%d", psh->pid);

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions