Skip to content

Conversation

@redwud
Copy link

@redwud redwud commented Apr 17, 2017

Hi there,

To prevent future buffer overflows, I think it would be best to use strlcat() instead of strcat().
Reference: https://www.us-cert.gov/bsi/articles/knowledge/coding-practices/strcpy-and-strcat

Thanks!

@redwud redwud closed this Apr 17, 2017
@redwud redwud reopened this Apr 17, 2017
@redwud
Copy link
Author

redwud commented Apr 17, 2017

diff --git a/Smartling.i18n/NSBundle+Smartling_i18n.m b/Smartling.i18n/NSBundle+Smartling_i18n.m
index 74a5cf0..b63fb62 100644
--- a/Smartling.i18n/NSBundle+Smartling_i18n.m
+++ b/Smartling.i18n/NSBundle+Smartling_i18n.m
@@ -79,8 +79,8 @@ - (NSString *)_pluralizedStringWithKey:(NSString *)key
  
  const char* form = pluralformf([lang cStringUsingEncoding:NSASCIIStringEncoding], pluralValue);
  char suffix[16] = "##{";
- strcat(suffix, form);
- strcat(suffix, "}");
+ strlcat(suffix, form, sizeof(suffix));
+ strlcat(suffix, "}", sizeof(suffix));
  NSString *keyVariant = [key stringByAppendingString:[NSString stringWithUTF8String:suffix]];
  NSDictionary *dict = [self stringsWithContentsOfFile:tableName forLocalization:locale];
  NSString *ls = dict[keyVariant];

@redwud
Copy link
Author

redwud commented May 10, 2017

@emilienh I will gladly appreciate if you can consider these simple changes and make this library a little secure.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant