fix a buffer overflow in string construction

The conditional in this code was the wrong way around. So the %s branch could be
taken only when the resulting sprintf would *definitely* overflow the target
buffer. From this we can conclude this branch was never safe and never used
correctly. For simplicity, we remove it, leaving only the %d option. Related to
!1620.

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 46a1cc67105b490e662ca8434a413c0e1a7ed1a5..4712657735282fb908a5b9a0d783629d9c839343 100644 (file)
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -61,6 +61,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - make fails if ps2pdf is not installed (using autotools) #1763
 - multiple graphs to file output causes a segfault #1845
 - lefty PTY functionality relies on file descriptor implementation details #1823
+- buffer overflow in fdpgen
 
 ## [2.44.1] - 2020-06-29
 

diff --git a/lib/fdpgen/layout.c b/lib/fdpgen/layout.c
index a1ad9178cc7099ec1858fcb779c4e601954c27cf..e0bf9d6d9544dc795843105e971efffbaacf5690 100644 (file)
--- a/lib/fdpgen/layout.c
+++ b/lib/fdpgen/layout.c
@@ -310,8 +310,7 @@ static void addCluster(clist_t * clist, graph_t * subg)
 
 /* portName:
  * Generate a name for a port.
- * We use the name of the subgraph and names of the nodes on the edge,
- * if possible. Otherwise, we use the ids of the nodes.
+ * We use the ids of the nodes.
  * This is for debugging. For production, just use edge id and some
  * id for the graph. Note that all the graphs are subgraphs of the
  * root graph.
@@ -322,13 +321,7 @@ static char *portName(graph_t * g, bport_t * p)
     node_t *h = aghead(e);
     node_t *t = agtail(e);
     static char buf[BSZ + 1];
-    int len = 8;
 
-    len += strlen(agnameof(g)) + strlen(agnameof(h)) + strlen(agnameof(t));
-    if (len >= BSZ)
-       sprintf(buf, "_port_%s_%s_%s_%ld", agnameof(g), agnameof(t), agnameof(h),
-               (uint64_t)AGSEQ(e));
-    else
        sprintf(buf, "_port_%s_(%d)_(%d)_%ld",agnameof(g), ND_id(t), ND_id(h),
                (uint64_t)AGSEQ(e));
     return buf;