You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The problem here is that we simply trust the method to return only the number of bytes we specify in the last argument.
If it returns more than our buffer can hold, we have a problem.
What might be a solution?
The code must be analysed and an alternative, secure solution implemented.
It is likely that this will also eliminate the method overloads.
The text was updated successfully, but these errors were encountered:
Am not sure where the problem is - the function is stripping so it's gonna return less by design.
Yes, we trust the function to do so, we have written it to do so! If you look at Strip Colors you will see it cannot build up a bigger string than it was given. Where is the non-secure code that needs fixing? 🤔
When I implemented the new exception message, I took the code from Discord.cpp to make the style consistent with the rest of the codebase.
It may not matter in this particular case, but it could introduce a new severe vulnerability in another situation!
Enforcing a secure code style will prevent such potential risks from being overlooked.
What's the problem?
The methods marked in the screenshot below have non-constant bounds:
They are used like in this example:
The problem here is that we simply trust the method to return only the number of bytes we specify in the last argument.
If it returns more than our buffer can hold, we have a problem.
What might be a solution?
The code must be analysed and an alternative, secure solution implemented.
It is likely that this will also eliminate the method overloads.
The text was updated successfully, but these errors were encountered: