Skip to content

fix: potential security issues - #49

Merged
pronskiy merged 4 commits into
mainfrom
fix/security-4
Apr 15, 2026
Merged

pronskiy merged 4 commits into
mainfrom
fix/security-4

Conversation

@pronskiy

Copy link
Copy Markdown
Member

No description provided.

…`ip_info.c`

⏺ Fixed ip_info.c:204 by:
  1. Bounding the sscanf %s with a width specifier (%IF_NAMESIZE s via stringification macros).
  2. Enlarging the local iface buffer to IF_NAMESIZE + 1 so the width-bounded write + null terminator fits safely.
  3. Replacing strcpy(interface, iface) with a bounded strncpy + explicit null-termination, since the caller-provided interface buffer
  is IF_NAMESIZE.
… cross-platform compatibility in `timing.c`.
…nd` in file locking logic.

Instead of calling freopen(tmp_fname, "w", fh) — which re-resolves the path
  and could open a different file than the one we stat'd and locked — we now truncate the already-locked file descriptor directly via
  ftruncate(fileno(fh), 0) and rewind. The operation now targets the same inode we hold the exclusive flock on, so a path swap between
  check and use can no longer redirect the write.

@carlos-granados carlos-granados left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍

@pronskiy
pronskiy merged commit 0d65bc7 into main Apr 15, 2026
16 of 18 checks passed
@carlos-granados
carlos-granados deleted the fix/security-4 branch May 5, 2026 16:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants