From d84a5f64717a2cd873c641ca154555fb180d0471 Mon Sep 17 00:00:00 2001 From: Paul Guenette Date: Sun, 12 May 2019 00:37:13 +0200 Subject: [PATCH] Fix buffer overflow issue in 'w' and 'r' commands --- Firmware/communication/ascii_protocol.cpp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Firmware/communication/ascii_protocol.cpp b/Firmware/communication/ascii_protocol.cpp index 1e1c9ba4..a9722bc6 100644 --- a/Firmware/communication/ascii_protocol.cpp +++ b/Firmware/communication/ascii_protocol.cpp @@ -216,7 +216,7 @@ void ASCII_protocol_process_line(const uint8_t* buffer, size_t len, StreamSink& } else if (cmd[0] == 'r') { // read property char name[MAX_LINE_LENGTH]; - int numscan = sscanf(cmd, "r %" TO_STR(MAX_LINE_LENGTH) "s", name); + int numscan = sscanf(cmd, "r %255s", name); if (numscan < 1) { respond(response_channel, use_checksum, "invalid command format"); } else { @@ -236,7 +236,7 @@ void ASCII_protocol_process_line(const uint8_t* buffer, size_t len, StreamSink& } else if (cmd[0] == 'w') { // write property char name[MAX_LINE_LENGTH]; char value[MAX_LINE_LENGTH]; - int numscan = sscanf(cmd, "w %" TO_STR(MAX_LINE_LENGTH) "s %" TO_STR(MAX_LINE_LENGTH) "s", name, value); + int numscan = sscanf(cmd, "w %255s %255s", name, value); if (numscan < 1) { respond(response_channel, use_checksum, "invalid command format"); } else {