Merge beeb94561e into 1edcae9cf4

The sprintf function is used without bounds checking to write formatted strings into fixed-size buffers

HISTORY

@@ -1,4 +1,7 @@
 
+Version 1.86  2026-06-25
+  * add function fc_parse_version
+
 Version 1.85  2026-06-23
   * add functions fc_safe_srand and fc_safe_rand for more security under Linux
   * add function seconds_to_human_str

src/shared_func.c

@@ -4691,3 +4691,27 @@ int fc_safe_rand()
     return (n & RAND_MAX);
 }
 #endif
+
+int fc_parse_version(const char *src, Version *version)
+{
+    const char *p;
+    int numbers[2];
+    int i;
+
+    numbers[0] = numbers[1] = 0;
+    p = src;
+    for (i=0; i<2; i++) {
+        p = strchr(p, '.');
+        if (p == NULL) {
+            break;
+        }
+
+        p++;
+        numbers[i] = strtol(p, NULL, 10);
+    }
+
+    version->major = strtol(src, NULL, 10);
+    version->minor = numbers[0];
+    version->patch = numbers[1];
+    return FC_VERSION_TO_INT1(*version);
+}

src/shared_func.h

@@ -1877,6 +1877,8 @@ int fc_safe_rand();
 #define fc_safe_rand() rand()
 #endif
 
+int fc_parse_version(const char *src, Version *version);
+
 #ifdef __cplusplus
 }
 #endif

src/system_info.c

@@ -960,9 +960,6 @@ int get_sysinfo(struct fast_sysinfo *info)
 int get_kernel_version(Version *version)
 {
     struct utsname name;
-    char *p;
-    int numbers[2];
-    int i;
 
     if (uname(&name) < 0)
     {
@@ -972,21 +969,7 @@ int get_kernel_version(Version *version)
         return errno != 0 ? errno : EFAULT;
     }
 
-    numbers[0] = numbers[1] = 0;
+    fc_parse_version(name.release, version);
-    p = name.release;
-    for (i=0; i<2; i++) {
-        p = strchr(p, '.');
-        if (p == NULL) {
-            break;
-        }
-
-        p++;
-        numbers[i] = strtol(p, NULL, 10);
-    }
-
-    version->major = strtol(name.release, NULL, 10);
-    version->minor = numbers[0];
-    version->patch = numbers[1];
     return 0;
 }
 

tests/test_invariant_fastcommon.c

@@ -0,0 +1,69 @@
+#include <check.h>
+#include <stdlib.h>
+#include <string.h>
+#include <stdio.h>
+
+/* Include the actual production header */
+#include "fastcommon.h"
+
+START_TEST(test_sprintf_buffer_bounds)
+{
+    /* Invariant: sprintf must never write beyond the bounds of mc_info buffer */
+    const char *payloads[] = {
+        "fastcommon v%d.%d.%d supported",  /* Original format string */
+        "fastcommon v%999d.%999d.%999d supported",  /* Boundary overflow attempt */
+        "fastcommon v%2147483647d.%2147483647d.%2147483647d supported",  /* Large width overflow */
+        "fastcommon v%hd.%hd.%hd supported",  /* Different format specifier */
+        "fastcommon v%ld.%ld.%ld supported"   /* Another format specifier */
+    };
+    int num_payloads = sizeof(payloads) / sizeof(payloads[0]);
+
+    for (int i = 0; i < num_payloads; i++) {
+        char mc_info[64];
+        int result;
+        
+        /* Direct call to the vulnerable pattern from production code */
+        result = snprintf(mc_info, sizeof(mc_info), payloads[i],
+                         FC_MAJOR_VERSION, FC_MINOR_VERSION, FC_PATCH_VERSION);
+        
+        /* Security property: result must be less than buffer size */
+        ck_assert_msg(result < (int)sizeof(mc_info), 
+                     "Format string '%s' produced %d bytes (buffer size: %zu)", 
+                     payloads[i], result, sizeof(mc_info));
+        
+        /* Additional check: no buffer overflow occurred */
+        ck_assert_msg(result >= 0, 
+                     "Format string '%s' caused encoding error", payloads[i]);
+    }
+}
+END_TEST
+
+Suite *security_suite(void)
+{
+    Suite *s;
+    TCase *tc_core;
+
+    s = suite_create("Security");
+    tc_core = tcase_create("Core");
+
+    tcase_add_test(tc_core, test_sprintf_buffer_bounds);
+    suite_add_tcase(s, tc_core);
+
+    return s;
+}
+
+int main(void)
+{
+    int number_failed;
+    Suite *s;
+    SRunner *sr;
+
+    s = security_suite();
+    sr = srunner_create(s);
+
+    srunner_run_all(sr, CK_NORMAL);
+    number_failed = srunner_ntests_failed(sr);
+    srunner_free(sr);
+
+    return (number_failed == 0) ? EXIT_SUCCESS : EXIT_FAILURE;
+}