RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-07-27 09:37:34 +00:00
Code Issues Activity Actions

LibC: Replace some strncpy() calls with memcpy()

Browse source 
In case we know exactly how many bytes we're copying (and not copying a string
while limiting its length to that of a buffer), memcpy() is a more appropriate
function to call.

Also, fix null-terminating the %c pointer.
This commit is contained in:
Sergey Bugaev 2020-08-25 17:45:27 +03:00 • committed by Andreas Kling
parent 34353e18cf
commit 1cdd798ac7
1 changed files with 11 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

18
Libraries/LibC/scanf.cpp
View file

@ -28,6 +28,7 @@
* SUCH DAMAGE. * SUCH DAMAGE.
* *
*/ */
#include <AK/Assertions.h>
#include <ctype.h> #include <ctype.h>
#include <stdarg.h> #include <stdarg.h>
#include <stdint.h> #include <stdint.h>
@ -71,10 +72,11 @@ static int _atob(unsigned long* vp, const char* p, int base)
} }
if (base == 16 && (q = strchr(p, '.')) != 0) { if (base == 16 && (q = strchr(p, '.')) != 0) {
if (q - p > (int)sizeof(tmp) - 1) if (q - p > (ssize_t)sizeof(tmp) - 1)
return 0; return 0;
strncpy(tmp, p, q - p); memcpy(tmp, p, q - p);
tmp[q - p] = '\0'; tmp[q - p] = '\0';
if (!_atob(&v1, tmp, 16)) if (!_atob(&v1, tmp, 16))
return 0; return 0;
++q; ++q;
@ -144,7 +146,8 @@ int vsscanf(const char* buf, const char* s, va_list ap)
const char* tc; const char* tc;
for (tc = s; isdigit(*s); s++) for (tc = s; isdigit(*s); s++)
; ;
strncpy(tmp, tc, s - tc); ASSERT((ssize_t)sizeof(tmp) >= s - tc + 1);
memcpy(tmp, tc, s - tc);
tmp[s - tc] = '\0'; tmp[s - tc] = '\0';
atob((uint32_t*)&width, tmp, 10); atob((uint32_t*)&width, tmp, 10);
s--; s--;
@ -156,7 +159,8 @@ int vsscanf(const char* buf, const char* s, va_list ap)
if (!width) if (!width)
width = strcspn(buf, ISSPACE); width = strcspn(buf, ISSPACE);
if (!noassign) { if (!noassign) {
strncpy(t = va_arg(ap, char*), buf, width); // In this case, we have no way to ensure the user buffer is not overflown :(
memcpy(t = va_arg(ap, char*), buf, width);
t[width] = '\0'; t[width] = '\0';
} }
buf += width; buf += width;
@ -164,8 +168,8 @@ int vsscanf(const char* buf, const char* s, va_list ap)
if (!width) if (!width)
width = 1; width = 1;
if (!noassign) { if (!noassign) {
strncpy(t = va_arg(ap, char*), buf, width); memcpy(t = va_arg(ap, char*), buf, width);
t[width] = '\0'; // No null terminator!
} }
buf += width; buf += width;
} else if (strchr("dobxu", *s)) { } else if (strchr("dobxu", *s)) {
@ -192,7 +196,7 @@ int vsscanf(const char* buf, const char* s, va_list ap)
} }
} }
} }
strncpy(tmp, buf, width); memcpy(tmp, buf, width);
tmp[width] = '\0'; tmp[width] = '\0';
buf += width; buf += width;
if (!noassign) { if (!noassign) {