fix: buffer write size

pubnub · Dec 10, 2024 · b5e86be · b5e86be
1 parent bc0727d
commit b5e86be
Show file tree

Hide file tree

Showing 3 changed files with 19 additions and 14 deletions.
diff --git a/core/pubnub_crypto.c b/core/pubnub_crypto.c
@@ -610,9 +610,10 @@ char* pn_pam_hmac_sha256_sign(char const* key, char const* message) {
 enum pubnub_res pn_gen_pam_v2_sign(pubnub_t* p, char const* qs_to_sign, char const* partial_url, char* signature) {
     enum pubnub_res sign_status = PNR_OK;
     int str_to_sign_len = strlen(p->core.subscribe_key) + strlen(p->core.publish_key) + strlen(partial_url) + strlen(qs_to_sign);
-    char* str_to_sign = (char*)malloc(sizeof(char) * str_to_sign_len + 5); // 4 variables concat + 1
+    size_t str_to_sign_size = sizeof(char) * str_to_sign_len + 5;
+    char* str_to_sign = (char*)malloc(str_to_sign_size); // 4 variables concat + 1
     if (str_to_sign != NULL) {
-	    snprintf(str_to_sign, sizeof(str_to_sign), "%s\n%s\n%s\n%s", p->core.subscribe_key, p->core.publish_key, partial_url, qs_to_sign);
+	    snprintf(str_to_sign, str_to_sign_size, "%s\n%s\n%s\n%s", p->core.subscribe_key, p->core.publish_key, partial_url, qs_to_sign);
     }
     PUBNUB_LOG_DEBUG("\nv2 str_to_sign = %s\n", str_to_sign);
     char* part_sign = (char*)"";
@@ -661,13 +662,14 @@ enum pubnub_res pn_gen_pam_v3_sign(pubnub_t* p, char const* qs_to_sign, char con
         return PNR_CRYPTO_NOT_SUPPORTED;
     }
     int str_to_sign_len = strlen(method_verb) + strlen(p->core.publish_key) + strlen(partial_url) + strlen(qs_to_sign) + 4 * strlen("\n") + (hasBody ? strlen(msg) : 0);
-    char* str_to_sign = (char*)malloc(sizeof(char) * (str_to_sign_len + 1));
+    size_t str_to_sign_size = sizeof(char) * (str_to_sign_len + 1);
+    char* str_to_sign = (char*)malloc(str_to_sign_size);
     if (str_to_sign != NULL) {
         if (hasBody) {
-	        snprintf(str_to_sign, sizeof(str_to_sign), "%s\n%s\n%s\n%s\n%s", method_verb, p->core.publish_key, partial_url, qs_to_sign, msg);
+	        snprintf(str_to_sign, str_to_sign_size, "%s\n%s\n%s\n%s\n%s", method_verb, p->core.publish_key, partial_url, qs_to_sign, msg);
         }
         else {
-	        snprintf(str_to_sign, sizeof(str_to_sign), "%s\n%s\n%s\n%s\n", method_verb, p->core.publish_key, partial_url, qs_to_sign);
+	        snprintf(str_to_sign, str_to_sign_size, "%s\n%s\n%s\n%s\n", method_verb, p->core.publish_key, partial_url, qs_to_sign);
         }
     }
     PUBNUB_LOG_DEBUG("\nv3 str_to_sign = %s\n", str_to_sign);

diff --git a/core/pubnub_grant_token_api.c b/core/pubnub_grant_token_api.c
@@ -210,8 +210,9 @@ static CborError data_recursion(CborValue* it, int nestingLevel, char** json_res
                     sig_flag = false;
                 }
                 else {
-                    char* buff_str = (char*)malloc(sizeof(char) * (n+3));
-                    snprintf(buff_str, sizeof(buff_str), "\"%s\"", buf);
+                    size_t buff_size = sizeof(char) * (n+3);
+                    char* buff_str = (char*)malloc(buff_size);
+                    snprintf(buff_str, buff_size, "\"%s\"", buf);
                     current_allocation_size = safe_alloc_strcat(json_result, buff_str, current_allocation_size);
                     free(buff_str);
                 }
@@ -234,15 +235,16 @@ static CborError data_recursion(CborValue* it, int nestingLevel, char** json_res
             size_t n;
             err = cbor_value_dup_text_string(it, &buf, &n, it);
             if (err) { return err; } // parse error
-
-	    char* txt_str = (char*)malloc(sizeof(char) * (n+4));
+
+	    size_t txt_size = sizeof(char) * (n+4);
+	    char* txt_str = (char*)malloc(txt_size);
 
 	    type = cbor_value_get_type(it);
 	    if (!uuid_flag) {
-	        snprintf(txt_str, sizeof(txt_str), "\"%s\":", buf);
+	        snprintf(txt_str, txt_size, "\"%s\":", buf);
 		    uuid_flag = false;
 	    } else {
-	        snprintf(txt_str, sizeof(txt_str), "\"%s\",", buf);
+	        snprintf(txt_str, txt_size, "\"%s\",", buf);
 	    }
 
 	    current_allocation_size = safe_alloc_strcat(json_result, txt_str, current_allocation_size);
@@ -358,7 +360,7 @@ char* pubnub_parse_token(pubnub_t* pb, char const* token){
 
     unsigned int init_allocation_size = 5*(strlen(rawToken)/4);
     char * json_result = (char*)malloc(init_allocation_size);
-	snprintf(json_result, sizeof(json_result), "%s", "");
+	snprintf(json_result, init_allocation_size, "%s", "");
     CborError err = cbor_parser_init(buf, length, 0, &parser, &it);
 
     if (!err){

diff --git a/core/pubnub_json_parse.c b/core/pubnub_json_parse.c
@@ -291,8 +291,9 @@ char* pbjson_get_status_400_message_value(struct pbjson_elem const* el)
             "pbjson_get_status_400_message_value: \"error\"='%.*s'\n",
             parse_len,
             parsed.start);
-        char* msgtext = (char*)malloc(sizeof(char) * (parse_len + 3));
-        snprintf(msgtext, sizeof(msgtext), "%.*s", parse_len, parsed.start);
+        size_t text_size = sizeof(char) * (parse_len + 3);
+        char*  msgtext   = (char*)malloc(text_size);
+        snprintf(msgtext, text_size, "%.*s", parse_len, parsed.start);
         return msgtext;
     }