From ff4b2bcfef0c45477ddc3256ab301f916b069ebb Mon Sep 17 00:00:00 2001 From: DL6ER Date: Wed, 17 Jun 2020 21:50:24 +0200 Subject: [PATCH] Zero-initialize memory on the stack to avoid picking up outdated content Signed-off-by: DL6ER --- src/api/dns.c | 2 +- src/api/ftl.c | 5 +++-- src/api/list.c | 10 +++++----- 3 files changed, 9 insertions(+), 8 deletions(-) diff --git a/src/api/dns.c b/src/api/dns.c index bc6fc38b..8a8ecb4a 100644 --- a/src/api/dns.c +++ b/src/api/dns.c @@ -53,7 +53,7 @@ static int set_blocking(struct mg_connection *conn) return send_json_unauthorized(conn); } - char buffer[1024]; + char buffer[1024] = { 0 }; const int data_len = mg_read(conn, buffer, sizeof(buffer) - 1); if ((data_len < 1) || (data_len >= (int)sizeof(buffer))) { return send_json_error(conn, 400, diff --git a/src/api/ftl.c b/src/api/ftl.c index 6673466f..2534462a 100644 --- a/src/api/ftl.c +++ b/src/api/ftl.c @@ -135,7 +135,8 @@ int api_ftl_database(struct mg_connection *conn) JSON_OBJ_ADD_NUMBER(json, "size", st.st_size); // Total size, in bytes // File type - char octal[5]; const char *human; + char octal[5] = { 0 }; + const char *human; cJSON *type = JSON_NEW_OBJ(); snprintf(octal, sizeof(octal), "%04o", (st.st_mode & S_IFMT) >> 9); JSON_OBJ_COPY_STR(type, "octal", octal); @@ -152,7 +153,7 @@ int api_ftl_database(struct mg_connection *conn) cJSON *mode = JSON_NEW_OBJ(); snprintf(octal, sizeof(octal), "%03o", st.st_mode & 0x1FF); JSON_OBJ_COPY_STR(mode, "octal", octal); - char permissions[10]; + char permissions[10] = { 0 }; get_permission_string(permissions, &st); JSON_OBJ_REF_STR(mode, "human", permissions); JSON_OBJ_ADD_ITEM(json, "mode", mode); diff --git a/src/api/list.c b/src/api/list.c index f542bbd8..791e5908 100644 --- a/src/api/list.c +++ b/src/api/list.c @@ -96,7 +96,7 @@ static int api_dns_domainlist_read(struct mg_connection *conn, bool exact, bool { // Extract domain from path (option for GET) const struct mg_request_info *request = mg_get_request_info(conn); - char domain_filter[1024]; + char domain_filter[1024] = { 0 }; // Advance one character to strip "/" const char *encoded_uri = strrchr(request->local_uri, '/')+1u; // Decode URL (necessary for regular expressions, harmless for domains) @@ -114,12 +114,12 @@ static int api_dns_domainlist_write(struct mg_connection *conn, const enum http_method method) { // Extract payload - char buffer[1024]; + char buffer[1024] = { 0 }; int data_len = mg_read(conn, buffer, sizeof(buffer) - 1); if ((data_len < 1) || (data_len >= (int)sizeof(buffer))) { return send_json_error(conn, 400, - "bad_request", "No request body data", - NULL); + "bad_request", "No request body data", + NULL); } buffer[data_len] = '\0'; @@ -205,7 +205,7 @@ static int api_dns_domainlist_remove(struct mg_connection *conn, { const struct mg_request_info *request = mg_get_request_info(conn); - char domain[1024]; + char domain[1024] = { 0 }; // Advance one character to strip "/" const char *encoded_uri = strrchr(request->local_uri, '/')+1u; // Decode URL (necessary for regular expressions, harmless for domains)