Skip to content

Commit 0c8df4f

Browse files
committed
Fix buffer overflow in process_option()
If no value is specified the option name is copied without checking the length. Avoid the unnecessary copy and eliminate the fixed size buffer completely.
1 parent e62a382 commit 0c8df4f

File tree

1 file changed

+15
-22
lines changed

1 file changed

+15
-22
lines changed

src/host/premake.c

Lines changed: 15 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -258,33 +258,26 @@ int process_arguments(lua_State* L, int argc, const char** argv)
258258
*/
259259
int process_option(lua_State* L, const char* arg)
260260
{
261-
char key[512];
262-
const char* value;
263-
264261
/* If a value is specified, split the option into a key/value pair */
265-
char* ptr = strchr(arg, '=');
266-
if (ptr)
262+
const char* value = strchr(arg, '=');
263+
if (value)
267264
{
268-
int len = (int)(ptr - arg);
269-
if (len > 511) len = 511;
270-
strncpy(key, arg, len);
271-
key[len] = '\0';
272-
value = ptr + 1;
265+
/* Store it in the Options table, which is already on the stack */
266+
lua_pushlstring(L, arg, value - arg);
267+
lua_pushstring(L, ++value);
268+
lua_settable(L, -4);
269+
270+
/* The /scripts option gets picked up here to find the built-in scripts */
271+
if (strncmp(arg, "scripts=", value - arg) == 0 && strlen(value) > 0)
272+
{
273+
scripts_path = value;
274+
}
273275
}
274276
else
275277
{
276-
strcpy(key, arg);
277-
value = "";
278-
}
279-
280-
/* Store it in the Options table, which is already on the stack */
281-
lua_pushstring(L, value);
282-
lua_setfield(L, -3, key);
283-
284-
/* The /scripts option gets picked up here to find the built-in scripts */
285-
if (strcmp(key, "scripts") == 0 && strlen(value) > 0)
286-
{
287-
scripts_path = value;
278+
/* No value, store empty string in the Options table */
279+
lua_pushliteral(L, "");
280+
lua_setfield(L, -3, arg);
288281
}
289282

290283
return OKAY;

0 commit comments

Comments
 (0)