sfeakes#135: Buffer overflow in action_web_request

ballle98 · Nov 18, 2020 · de5c868 · de5c868
1 parent e360cba
commit de5c868
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/net_services.c b/net_services.c
@@ -1076,7 +1076,7 @@ void action_web_request(struct mg_connection *nc, struct http_message *http_msg)
     }
   //} else if (strstr(http_msg->method.p, "PUT")) {
   } else {
-    char buf[50];
+    char buf[200];
     float value = 0;
     DEBUG_TIMER_START(&tid);
 
@@ -1160,7 +1160,8 @@ void action_web_request(struct mg_connection *nc, struct http_message *http_msg)
       mg_send_head(nc, 200, strlen(GET_RTN_UNKNOWN), CONTENT_TEXT);
       mg_send(nc, GET_RTN_UNKNOWN, strlen(GET_RTN_UNKNOWN));
     }
-    sprintf(buf, "action_web_request() request '%.*s' took",http_msg->uri.len, http_msg->uri.p);
+    snprintf(buf, sizeof(buf), "action_web_request() request '%.*s' took",
+             http_msg->uri.len, http_msg->uri.p);
 
     DEBUG_TIMER_STOP(tid, NET_LOG, buf);
   }