Fix buffer overflow and length-truncation bugs in RTP SDES packet builder#810
Open
MarkRose wants to merge 1 commit into
Open
Fix buffer overflow and length-truncation bugs in RTP SDES packet builder#810MarkRose wants to merge 1 commit into
MarkRose wants to merge 1 commit into
Conversation
…lder - rtp_make_sdes() used sprintf(tmp, "%-15s%s", callsign, name) into a fixed 256-byte stack buffer with no bounds checking. A configured station name or callsign longer than roughly 240 bytes overflows the buffer. Switched to snprintf(tmp, sizeof(tmp), ...) to bound the write to the buffer size. - The addText() macro stored the text length in a single byte (*block++ = sl) but then memcpy'd the full, untruncated length (sl) into the output buffer. For any string longer than 255 bytes, the on-wire length field would wrap/truncate while memcpy still copied the full length, corrupting the packet layout and writing past the intended bounds of the SDES buffer. The macro now clamps the length to 255 before both recording it and copying it, so the copied data always matches the recorded length. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
MarkRose
force-pushed
the
fix-rtpacket-sdes-sprintf
branch
from
July 11, 2026 23:07
6dca554 to
e12788b
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
rtp_make_sdes() used sprintf(tmp, "%-15s%s", callsign, name) into a
fixed 256-byte stack buffer with no bounds checking. A configured
station name or callsign longer than roughly 240 bytes overflows the
buffer. Switched to snprintf(tmp, sizeof(tmp), ...) to bound the write
to the buffer size.
The addText() macro stored the text length in a single byte
(*block++ = sl) but then memcpy'd the full, untruncated length (sl)
into the output buffer. For any string longer than 255 bytes, the
on-wire length field would wrap/truncate while memcpy still copied
the full length, corrupting the packet layout and writing past the
intended bounds of the SDES buffer. The macro now clamps the length
to 255 before both recording it and copying it, so the copied data
always matches the recorded length.
Co-Authored-By: Claude Opus 4.8 noreply@anthropic.com
This PR also adds a unit test (
RtPacketTest.cpp). It is auto-discovered and executed by the CTest suite proposed in #762 once that is merged; without that suite present the test file is inert and does not affect the build.