nvram: 🛡️ Sentinel: [security improvement] Replace unsafe sprintf with snprintf#180
Conversation
…h snprintf Replaced all instances of `sprintf` with `snprintf` in nvram.c to prevent potential buffer overflows. Signed-off-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com> Co-authored-by: manupawickramasinghe <[email protected]>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
…ntf with snprintf Replaced all instances of `sprintf` with `snprintf` in nvram.c to prevent potential buffer overflows. Also fixed dynamic VLA allocation issue and added missing stdlib.h. Signed-off-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com> Co-authored-by: manupawickramasinghe <[email protected]>
🚨 Severity: Medium
💡 Vulnerability: Unsafe C function
sprintfis used in multiple places withinnvram.cto format strings into fixed-size buffers. This could lead to buffer overflows if the formatted data exceeds the buffer size, allowing memory corruption or arbitrary code execution.🎯 Impact: A malicious actor could craft specific nvram values or headers to trigger an overflow, potentially leading to privilege escalation or denial of service on the device running OpenWrt.
🔧 Fix: Replaced all instances of
sprintfwithsnprintf, ensuring that formatting never writes past the allocated memory buffer.✅ Verification: Ran
sh test_ci.shto verify tests pass. Visually inspected the code diff to ensure allsprintfcalls were changed tosnprintf.Signed-off-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
PR created automatically by Jules for task 11729375659188088495 started by @manupawickramasinghe