- Notifications
You must be signed in to change notification settings - Fork1.3k
lsteamclinet: fixed potential stack-based buffer overflow in unixlib#8785
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.
Already on GitHub?Sign in to your account
base:proton_10.0
Are you sure you want to change the base?
Uh oh!
There was an error while loading.Please reload this page.
Conversation
jammy3855 commentedJul 17, 2025
Per the man page for
This will copy unnecessary NUL characters if
Per the Stack Overflow link below, the fix could look like: But So the final fix would look like: Nevertheless, the current change does address the issue 😄 |
Reodus commentedJul 17, 2025
Good point about strncat — makes total sense and yeah, definitely cleaner than strncpy in this case. I’ve updated the patch to use that instead. Appreciate the suggestion! |
This patch addresses a stack-based buffer overflow in the
steamclient_dos_to_unix_pathfunction.The original implementation used
strcpyto copy thesrcstring into a fixed-size stack buffer (char buffer[4096]) without bounds checking. This could lead to buffer overflow if the input string exceeds the buffer size, potentially causing crashes or unexpected behavior.This fix replaces the unsafe
strcpycall withstrncpy, and ensures null-termination by explicitly setting the last byte of the buffer to\0. This change mitigates the overflow risk while preserving the original logic of the function.Summary of changes:
strcpy(dst, src)withstrncpy(dst, src, sizeof(buffer) - 1)dst[sizeof(buffer) - 1] = '\0'to guarantee null-termination