Views
No views yet
find_replace() in src/utils.c:221 uses sprintf(buffer, "%s", str) to copy an input string into a fixed char buffer[4096] on the stack. When the input string exceeds 4096 bytes, a stack buffer overflow occurs. This function is called with user-controlled file paths from .list training data files.poc_sprintf_overflow.c — Standalone harness demonstrating the overflow with the exact vulnerable function from src/utils.c:216-2301gcc -fsanitize=address -fno-omit-frame-pointer -O0 -g poc_sprintf_overflow.c -o poc_sprintf
2./poc_sprintfAddressSanitizer: stack-buffer-overflow in find_replace