Skip to content

Commit 62ccd05

Browse files
pstefpstef
committed
Try to avoid overflowing the stack
PATH_MAX_LENGTH is pretty short on CTR and not really adequate here since this buffer is not storing a path. Allocate and possibly reallocate from heap instead of using the stack here.
1 parent 51b13fc commit 62ccd05

1 file changed

Lines changed: 46 additions & 33 deletions

File tree

‎menu/cbs/menu_cbs_deferred_push.c‎

Lines changed: 46 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -421,8 +421,8 @@ GENERIC_DEFERRED_CURSOR_MANAGER(deferred_push_cursor_manager_list_deferred_query
421421
static int general_push(menu_displaylist_info_t *info,
422422
unsigned id, enum menu_displaylist_ctl_state state)
423423
{
424-
char newstr2[PATH_MAX_LENGTH*2];
425-
size_t _len = 0;
424+
char *newstr2;
425+
size_t _len = 0, size;
426426
settings_t *settings = config_get_ptr();
427427
menu_handle_t *menu = menu_state_get_ptr()->driver_data;
428428
#if defined(HAVE_FFMPEG) || defined(HAVE_MPV) || defined (HAVE_AUDIOMIXER)
@@ -468,6 +468,8 @@ static int general_push(menu_displaylist_info_t *info,
468468
info->type_default = FILE_TYPE_PLAIN;
469469
if (id != PUSH_DETECT_CORE_LIST)
470470
info->setting = menu_setting_find_enum(info->enum_idx);
471+
if (!(newstr2 = malloc(size = PATH_MAX_LENGTH)))
472+
return -1;
471473
newstr2[0] = '\0';
472474

473475
switch (id)
@@ -477,8 +479,8 @@ static int general_push(menu_displaylist_info_t *info,
477479
struct retro_system_info *sysinfo =
478480
&runloop_state_get_ptr()->system.info;
479481
if (sysinfo && !string_is_empty(sysinfo->valid_extensions))
480-
_len = strlcpy(newstr2 + _len, sysinfo->valid_extensions,
481-
sizeof(newstr2) - _len);
482+
_len += strlcpy(newstr2 + _len, sysinfo->valid_extensions,
483+
size - _len);
482484
}
483485
break;
484486
case PUSH_DEFAULT:
@@ -497,17 +499,17 @@ static int general_push(menu_displaylist_info_t *info,
497499

498500
if (!string_is_empty(valid_extensions))
499501
{
500-
_len += strlcpy(newstr2 + _len, valid_extensions, sizeof(newstr2) - _len);
502+
_len += strlcpy(newstr2 + _len, valid_extensions, size - _len);
501503
#ifdef HAVE_IBXM
502504
if (_len > 0 && newstr2[_len-1] != '\0')
503-
_len += strlcpy(newstr2 + _len, "|", sizeof(newstr2) - _len);
504-
_len += strlcpy(newstr2 + _len, "s3m", sizeof(newstr2) - _len);
505+
_len += strlcpy(newstr2 + _len, "|", size - _len);
506+
_len += strlcpy(newstr2 + _len, "s3m", size - _len);
505507
if (_len > 0 && newstr2[_len-1] != '\0')
506-
_len += strlcpy(newstr2 + _len, "|", sizeof(newstr2) - _len);
507-
_len += strlcpy(newstr2 + _len, "mod", sizeof(newstr2) - _len);
508+
_len += strlcpy(newstr2 + _len, "|", size - _len);
509+
_len += strlcpy(newstr2 + _len, "mod", size - _len);
508510
if (_len > 0 && newstr2[_len-1] != '\0')
509-
_len += strlcpy(newstr2 + _len, "|", sizeof(newstr2) - _len);
510-
_len += strlcpy(newstr2 + _len, "xm", sizeof(newstr2) - _len);
511+
_len += strlcpy(newstr2 + _len, "|", size - _len);
512+
_len += strlcpy(newstr2 + _len, "xm", size - _len);
511513
#endif
512514
}
513515
}
@@ -522,7 +524,7 @@ static int general_push(menu_displaylist_info_t *info,
522524
if (sysinfo && !string_is_empty(sysinfo->valid_extensions))
523525
_len += strlcpy(newstr2 + _len,
524526
sysinfo->valid_extensions,
525-
sizeof(newstr2) - _len);
527+
size - _len);
526528

527529
if (!filter_by_current_core)
528530
{
@@ -560,11 +562,20 @@ static int general_push(menu_displaylist_info_t *info,
560562
* add it */
561563
if (!exists)
562564
{
565+
if (_len + strlen(tok) > size - 1 - 1) {
566+
char *reallocated = realloc(newstr2, size += PATH_MAX_LENGTH);
567+
568+
if (!reallocated) {
569+
free(newstr2);
570+
return -1;
571+
}
572+
newstr2 = reallocated;
573+
}
563574
if (_len > 0 && newstr2[_len-1] != '\0')
564575
_len += strlcpy(newstr2 + _len, "|",
565-
sizeof(newstr2) - _len);
576+
size - _len);
566577
_len += strlcpy(newstr2 + _len, tok,
567-
sizeof(newstr2) - _len);
578+
size - _len);
568579
}
569580
}
570581

@@ -578,32 +589,32 @@ static int general_push(menu_displaylist_info_t *info,
578589
{
579590
#if defined(HAVE_DR_MP3)
580591
if (_len > 0 && newstr2[_len-1] != '\0')
581-
_len += strlcpy(newstr2 + _len, "|", sizeof(newstr2) - _len);
582-
_len += strlcpy(newstr2 + _len, "mp3", sizeof(newstr2) - _len);
592+
_len += strlcpy(newstr2 + _len, "|", size - _len);
593+
_len += strlcpy(newstr2 + _len, "mp3", size - _len);
583594
#endif
584595
#if defined(HAVE_STB_VORBIS)
585596
if (_len > 0 && newstr2[_len-1] != '\0')
586-
_len += strlcpy(newstr2 + _len, "|", sizeof(newstr2) - _len);
587-
_len += strlcpy(newstr2 + _len, "ogg", sizeof(newstr2) - _len);
597+
_len += strlcpy(newstr2 + _len, "|", size - _len);
598+
_len += strlcpy(newstr2 + _len, "ogg", size - _len);
588599
#endif
589600
#if defined(HAVE_DR_FLAC)
590601
if (_len > 0 && newstr2[_len-1] != '\0')
591-
_len += strlcpy(newstr2 + _len, "|", sizeof(newstr2) - _len);
592-
_len += strlcpy(newstr2 + _len, "flac", sizeof(newstr2) - _len);
602+
_len += strlcpy(newstr2 + _len, "|", size - _len);
603+
_len += strlcpy(newstr2 + _len, "flac", size - _len);
593604
#endif
594605
#if defined(HAVE_RWAV)
595606
if (_len > 0 && newstr2[_len-1] != '\0')
596-
_len += strlcpy(newstr2 + _len, "|", sizeof(newstr2) - _len);
597-
_len += strlcpy(newstr2 + _len, "wav", sizeof(newstr2) - _len);
607+
_len += strlcpy(newstr2 + _len, "|", size - _len);
608+
_len += strlcpy(newstr2 + _len, "wav", size - _len);
598609
#endif
599610
#ifdef HAVE_IBXM
600611
if (_len > 0 && newstr2[_len-1] != '\0')
601-
_len += strlcpy(newstr2 + _len, "|", sizeof(newstr2) - _len);
602-
_len += strlcpy(newstr2 + _len, "s3m", sizeof(newstr2) - _len);
603-
_len += strlcpy(newstr2 + _len, "|", sizeof(newstr2) - _len);
604-
_len += strlcpy(newstr2 + _len, "mod", sizeof(newstr2) - _len);
605-
_len += strlcpy(newstr2 + _len, "|", sizeof(newstr2) - _len);
606-
_len += strlcpy(newstr2 + _len, "xm", sizeof(newstr2) - _len);
612+
_len += strlcpy(newstr2 + _len, "|", size - _len);
613+
_len += strlcpy(newstr2 + _len, "s3m", size - _len);
614+
_len += strlcpy(newstr2 + _len, "|", size - _len);
615+
_len += strlcpy(newstr2 + _len, "mod", size - _len);
616+
_len += strlcpy(newstr2 + _len, "|", size - _len);
617+
_len += strlcpy(newstr2 + _len, "xm", size - _len);
607618
#endif
608619
}
609620
#endif
@@ -622,9 +633,9 @@ static int general_push(menu_displaylist_info_t *info,
622633
#endif
623634
if (_len > 0 && newstr2[_len-1] != '\0')
624635
_len += strlcpy(newstr2 + _len, "|",
625-
sizeof(newstr2) - _len);
636+
size - _len);
626637
_len += strlcpy(newstr2 + _len, sysinfo.valid_extensions,
627-
sizeof(newstr2) - _len);
638+
size - _len);
628639
}
629640
#endif
630641

@@ -635,18 +646,20 @@ static int general_push(menu_displaylist_info_t *info,
635646
libretro_imageviewer_retro_get_system_info(&sysinfo);
636647
if (_len > 0 && newstr2[_len-1] != '\0')
637648
_len += strlcpy(newstr2 + _len, "|",
638-
sizeof(newstr2) - _len);
649+
size - _len);
639650
_len += strlcpy(newstr2 + _len, sysinfo.valid_extensions,
640-
sizeof(newstr2) - _len);
651+
size - _len);
641652
}
642653
#endif
643654

644655
if (!string_is_empty(newstr2))
645656
{
646657
if (info->exts)
647658
free(info->exts);
648-
info->exts = strdup(newstr2);
659+
info->exts = newstr2;
649660
}
661+
else
662+
free(newstr2);
650663

651664
return deferred_push_dlist(info, state, settings);
652665
}

0 commit comments

Comments
 (0)