From 3bc520a2df30a020de9246b7d12e60d9a1c5a41e Mon Sep 17 00:00:00 2001 From: orbisai0security Date: Fri, 8 May 2026 07:23:44 +0000 Subject: [PATCH 1/3] fix: the argument parsing function copies a command-... in oapv_app_a... The argument parsing function copies a command-line argument string directly into a fixed-size destination buffer (ops->val) using strcpy, which performs no length validation --- app/oapv_app_args.h | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/app/oapv_app_args.h b/app/oapv_app_args.h index e7a1fff2..c041466b 100644 --- a/app/oapv_app_args.h +++ b/app/oapv_app_args.h @@ -57,6 +57,7 @@ typedef struct args_opt { int val_type; /* value type */ int flag; /* flag to setting or not */ void *val; /* actual value */ + int val_len; /* buffer length for string values */ char desc[1024]; /* description of option */ } args_opt_t; @@ -124,7 +125,10 @@ static int args_read_value(args_opt_t *ops, const char *argv) break; case ARGS_VAL_TYPE_STRING: - strcpy((char *)ops->val, argv); + if(ops->val_len > 0) { + strncpy((char *)ops->val, argv, (size_t)(ops->val_len - 1)); + ((char *)ops->val)[ops->val_len - 1] = '\0'; + } break; default: @@ -314,7 +318,7 @@ static int args_parse_cmd(int argc, const char *argv[], args_opt_t *ops, return -1; } -static int args_set_variable_by_key_long(args_opt_t *opts, char *key_long, void *var) +static int _args_set_variable_by_key_long(args_opt_t *opts, char *key_long, void *var, int val_len) { int idx; char buf[ARGS_MAX_KEY_LONG]; @@ -337,9 +341,13 @@ static int args_set_variable_by_key_long(args_opt_t *opts, char *key_long, void if(idx < 0) return -1; opts[idx].val = var; + opts[idx].val_len = val_len; return 0; } +#define args_set_variable_by_key_long(opts, key_long, var) \ + _args_set_variable_by_key_long(opts, key_long, (void *)(var), (int)sizeof(var)) + static int args_set_variable_by_key(args_opt_t *opts, char *key, void *var) { int idx; From 67b7274b6c8460b7385405682645bf39dff7fe3d Mon Sep 17 00:00:00 2001 From: OrbisAI Security Date: Wed, 17 Jun 2026 12:21:10 +0530 Subject: [PATCH 2/3] adding a check of return -1 if the input string is too long --- app/oapv_app_args.h | 3 +++ 1 file changed, 3 insertions(+) diff --git a/app/oapv_app_args.h b/app/oapv_app_args.h index c041466b..2207f29c 100644 --- a/app/oapv_app_args.h +++ b/app/oapv_app_args.h @@ -126,6 +126,9 @@ static int args_read_value(args_opt_t *ops, const char *argv) case ARGS_VAL_TYPE_STRING: if(ops->val_len > 0) { + if(strlen(argv) >= (size_t)ops->val_len) { + return -1; + } strncpy((char *)ops->val, argv, (size_t)(ops->val_len - 1)); ((char *)ops->val)[ops->val_len - 1] = '\0'; } From 2836dfc67852631b522854acd288a749c4e11050 Mon Sep 17 00:00:00 2001 From: OrbisAI Security Date: Fri, 26 Jun 2026 16:05:42 +0530 Subject: [PATCH 3/3] fix: val_len is only set for STRING type args in _args_set_variable_by_key_long For non-STRING opts (INTEGER, FLAG), sizeof(var) evaluates to sizeof(pointer) rather than sizeof(int), producing a misleading val_len of 8. Since val_len is only read in the ARGS_VAL_TYPE_STRING branch of args_read_value(), zero it for all other types to make the invariant explicit and prevent future misuse. Co-Authored-By: Claude Sonnet 4.6 --- app/oapv_app_args.h | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/app/oapv_app_args.h b/app/oapv_app_args.h index 2207f29c..11ac582c 100644 --- a/app/oapv_app_args.h +++ b/app/oapv_app_args.h @@ -57,7 +57,7 @@ typedef struct args_opt { int val_type; /* value type */ int flag; /* flag to setting or not */ void *val; /* actual value */ - int val_len; /* buffer length for string values */ + int val_len; /* buffer length; only used for ARGS_VAL_TYPE_STRING */ char desc[1024]; /* description of option */ } args_opt_t; @@ -344,7 +344,12 @@ static int _args_set_variable_by_key_long(args_opt_t *opts, char *key_long, void if(idx < 0) return -1; opts[idx].val = var; - opts[idx].val_len = val_len; + if(ARGS_GET_CMD_OPT_VAL_TYPE(opts[idx].val_type) == ARGS_VAL_TYPE_STRING) { + opts[idx].val_len = val_len; + } + else { + opts[idx].val_len = 0; + } return 0; }