From db44129ec099a05debf9187da2fd09035c9a67d7 Mon Sep 17 00:00:00 2001 From: David Sidrane Date: Wed, 12 Oct 2016 04:11:12 -1000 Subject: [PATCH] Prevents the posibility of buffer overflow in mixer parsing. The fix limits scanf from overwritting the geomname buffer local variable. Thus preventing stack corruption as noted by chungkim. --- src/modules/systemlib/mixer/mixer_multirotor.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/modules/systemlib/mixer/mixer_multirotor.cpp b/src/modules/systemlib/mixer/mixer_multirotor.cpp index 8cbccbee4f..950bf3d687 100644 --- a/src/modules/systemlib/mixer/mixer_multirotor.cpp +++ b/src/modules/systemlib/mixer/mixer_multirotor.cpp @@ -132,7 +132,7 @@ MultirotorMixer::from_text(Mixer::ControlCallback control_cb, uintptr_t cb_handl } - if (sscanf(buf, "R: %s %d %d %d %d%n", geomname, &s[0], &s[1], &s[2], &s[3], &used) != 5) { + if (sscanf(buf, "R: %7s %d %d %d %d%n", geomname, &s[0], &s[1], &s[2], &s[3], &used) != 5) { debug("multirotor parse failed on '%s'", buf); return nullptr; }