From b62bb20e6f2842833e945c2fb4b839b59ba705bf Mon Sep 17 00:00:00 2001 From: Holger Vogt Date: Sat, 18 Nov 2023 10:55:19 +0100 Subject: [PATCH] Increase the allowable node name length from 24 to 256. Enable safe copying, no user induced buffer overflow. --- src/include/ngspice/swec.h | 2 +- src/spicelib/devices/cpl/cplsetup.c | 3 ++- src/spicelib/devices/txl/txlsetup.c | 3 ++- 3 files changed, 5 insertions(+), 3 deletions(-) diff --git a/src/include/ngspice/swec.h b/src/include/ngspice/swec.h index 28c644fdd..e5ffe8720 100644 --- a/src/include/ngspice/swec.h +++ b/src/include/ngspice/swec.h @@ -184,7 +184,7 @@ typedef struct linked_lists_of_Bpoint{ } BPOINT, *BPOINTPTR; typedef struct linked_lists_of_nodeName{ - char id[24]; + char id[256]; struct linked_lists_of_nodeName *left, *right; NODE *nd; } NDname, *NDnamePt; diff --git a/src/spicelib/devices/cpl/cplsetup.c b/src/spicelib/devices/cpl/cplsetup.c index f80da3dd0..7e9052fb1 100644 --- a/src/spicelib/devices/cpl/cplsetup.c +++ b/src/spicelib/devices/cpl/cplsetup.c @@ -1934,7 +1934,8 @@ insert_ND(char* name, NDnamePt* ndn) memsaved(p); p->nd = NULL; p->right = p->left = NULL; - strcpy(p->id, name); + strncpy(p->id, name, 255); + p->id[255] = '\0'; return(p); } cmp = strcmp((*ndn)->id, name); diff --git a/src/spicelib/devices/txl/txlsetup.c b/src/spicelib/devices/txl/txlsetup.c index 01192d6d4..effc0be8b 100644 --- a/src/spicelib/devices/txl/txlsetup.c +++ b/src/spicelib/devices/txl/txlsetup.c @@ -1035,7 +1035,8 @@ insert_ND(char *name, NDnamePt *ndn) p = *ndn = TMALLOC(NDname, 1); p->nd = NULL; p->right = p->left = NULL; - strcpy(p->id, name); + strncpy(p->id, name, 255); + p->id[255] = '\0'; return(p); } cmp = strcmp((*ndn)->id, name);