Zero-initialize memory on the stack to avoid picking up outdated content

Signed-off-by: DL6ER <dl6er@dl6er.de>

src/api/dns.c

@@ -53,7 +53,7 @@ static int set_blocking(struct mg_connection *conn)
 		return send_json_unauthorized(conn);
 	}
 
-	char buffer[1024];
+	char buffer[1024] = { 0 };
 	const int data_len = mg_read(conn, buffer, sizeof(buffer) - 1);
 	if ((data_len < 1) || (data_len >= (int)sizeof(buffer))) {
 		return send_json_error(conn, 400,

src/api/ftl.c

@@ -135,7 +135,8 @@ int api_ftl_database(struct mg_connection *conn)
 	JSON_OBJ_ADD_NUMBER(json, "size", st.st_size); // Total size, in bytes
 
 	// File type
-	char octal[5]; const char *human;
+	char octal[5] = { 0 };
+	const char *human;
 	cJSON *type = JSON_NEW_OBJ();
 	snprintf(octal, sizeof(octal), "%04o", (st.st_mode & S_IFMT) >> 9);
 	JSON_OBJ_COPY_STR(type, "octal", octal);
@@ -152,7 +153,7 @@ int api_ftl_database(struct mg_connection *conn)
 	cJSON *mode = JSON_NEW_OBJ();
 	snprintf(octal, sizeof(octal), "%03o", st.st_mode & 0x1FF);
 	JSON_OBJ_COPY_STR(mode, "octal", octal);
-	char permissions[10];
+	char permissions[10] = { 0 };
 	get_permission_string(permissions, &st);
 	JSON_OBJ_REF_STR(mode, "human", permissions);
 	JSON_OBJ_ADD_ITEM(json, "mode", mode);

src/api/list.c

@@ -96,7 +96,7 @@ static int api_dns_domainlist_read(struct mg_connection *conn, bool exact, bool
 {
 	// Extract domain from path (option for GET)
 	const struct mg_request_info *request = mg_get_request_info(conn);
-	char domain_filter[1024];
+	char domain_filter[1024] = { 0 };
 	// Advance one character to strip "/"
 	const char *encoded_uri = strrchr(request->local_uri, '/')+1u;
 	// Decode URL (necessary for regular expressions, harmless for domains)
@@ -114,12 +114,12 @@ static int api_dns_domainlist_write(struct mg_connection *conn,
                                     const enum http_method method)
 {
 	// Extract payload
-	char buffer[1024];
+	char buffer[1024] = { 0 };
 	int data_len = mg_read(conn, buffer, sizeof(buffer) - 1);
 	if ((data_len < 1) || (data_len >= (int)sizeof(buffer))) {
 		return send_json_error(conn, 400,
-                                       "bad_request", "No request body data",
-                                       NULL);
+		                       "bad_request", "No request body data",
+		                       NULL);
 	}
 	buffer[data_len] = '\0';
 
@@ -205,7 +205,7 @@ static int api_dns_domainlist_remove(struct mg_connection *conn,
 {
 	const struct mg_request_info *request = mg_get_request_info(conn);
 
-	char domain[1024];
+	char domain[1024] = { 0 };
 	// Advance one character to strip "/"
 	const char *encoded_uri = strrchr(request->local_uri, '/')+1u;
 	// Decode URL (necessary for regular expressions, harmless for domains)