commit c1a4b3f179e6e8bf42ba5fe8d8a49fc4c042699f
author Simo Sorce <simo@redhat.com> Tue May 11 14:24:15 2021 -0400
committer Simo Sorce <simo@redhat.com> Tue May 11 14:26:32 2021 -0400
tree 5a1b45658ebe542f14f38b068d938aead43678d0
parent c54e523d9dacdb7eec7f20964df12df9b80f467c

Fix potential buffer overflow via fscanf

Scanner Output
--------------
Error: DC.STREAM_BUFFER (CWE-120): [#def4]
libtasn1-4.16.0/src/asn1Coding.c:75: dont_call: "fscanf" assumes an arbitrarily long string, so callers must use correct precision specifiers or never use "fscanf".
libtasn1-4.16.0/src/asn1Coding.c:75: remediation: Use correct precision specifiers or implement your own parsing.
 #   73|     int ret;
 #   74|
 #   75|->   ret = fscanf (file, "%s", varName);
 #   76|     if (ret == EOF)
 #   77|       return ASSIGNMENT_EOF;

Error: DC.STREAM_BUFFER (CWE-120): [#def5]
libtasn1-4.16.0/src/asn1Coding.c:81: dont_call: "fscanf" assumes an arbitrarily long string, so callers must use correct precision specifiers or never use "fscanf".
libtasn1-4.16.0/src/asn1Coding.c:81: remediation: Use correct precision specifiers or implement your own parsing.
 #   79|       varName[0] = 0;
 #   80|
 #   81|->   ret = fscanf (file, "%s", value);
 #   82|     if (ret == EOF)
 #   83|       return ASSIGNMENT_ERROR;

Signed-off-by: Simo Sorce <simo@redhat.com>

src/asn1Coding.c

diff --git a/src/asn1Coding.c b/src/asn1Coding.c
index 381a1c3..9b54a75 100644
--- a/src/asn1Coding.c
+++ b/src/asn1Coding.c
@@ -72,13 +72,13 @@
 
   int ret;
 
-  ret = fscanf (file, "%s", varName);
+  ret = fscanf (file, "%1023s", varName);
   if (ret == EOF)
     return ASSIGNMENT_EOF;
   if (!strcmp (varName, "''"))
     varName[0] = 0;
 
-  ret = fscanf (file, "%s", value);
+  ret = fscanf (file, "%1023s", value);
   if (ret == EOF)
     return ASSIGNMENT_ERROR;