Skip to content

Commit 65c2dee

Browse files
CopilotRbb666
andcommitted
Fix buffer overflow when object name exceeds RT_NAME_MAX
- Truncate obj_name_len to RT_NAME_MAX - 1 before memcpy - Prevents buffer overflow in both rt_object_init() and rt_object_allocate() - Ensures safe truncation of long object names Co-authored-by: Rbb666 <[email protected]>
1 parent 6ce5619 commit 65c2dee

File tree

1 file changed

+2
-0
lines changed

1 file changed

+2
-0
lines changed

src/object.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -399,6 +399,7 @@ void rt_object_init(struct rt_object *object,
399399
if(obj_name_len > RT_NAME_MAX - 1)
400400
{
401401
LOG_E("Object name %s exceeds RT_NAME_MAX=%d, consider increasing RT_NAME_MAX.", name, RT_NAME_MAX);
402+
obj_name_len = RT_NAME_MAX - 1;
402403
}
403404
rt_memcpy(object->name, name, obj_name_len);
404405
object->name[obj_name_len] = '\0';
@@ -514,6 +515,7 @@ rt_object_t rt_object_allocate(enum rt_object_class_type type, const char *name)
514515
if(obj_name_len > RT_NAME_MAX - 1)
515516
{
516517
LOG_E("Object name %s exceeds RT_NAME_MAX=%d, consider increasing RT_NAME_MAX.", name, RT_NAME_MAX);
518+
obj_name_len = RT_NAME_MAX - 1;
517519
}
518520
rt_memcpy(object->name, name, obj_name_len);
519521
object->name[obj_name_len] = '\0';

0 commit comments

Comments
 (0)