From 24162479dfaff738b819467b8077700324f417ac Mon Sep 17 00:00:00 2001 From: austinbenoit Date: Mon, 26 Oct 2026 21:11:30 +0000 Subject: [PATCH 1/2] Fix buffer overflow in Android LogException via std::string concatenation Replace the two strncat(buf, ..., sizeof(buf) - 1) calls in firebase::util::LogException with std::string concatenation, and use a stack-local buffer instead of a non-thread-safe static buffer when formatting log_fmt with vsnprintf. Resolves GitHub Code Scanning security alerts (Rule WS-C-00155): - https://github.com/firebase/firebase-cpp-sdk/security/code-scanning/2786 - https://github.com/firebase/firebase-cpp-sdk/security/code-scanning/2787 --- app/src/util_android.cc | 13 +++++-------- release_build_files/readme.md | 5 +++++ 2 files changed, 10 insertions(+), 8 deletions(-) diff --git a/app/src/util_android.cc b/app/src/util_android.cc index 1ad15f0c4f..d68f9b0124 100644 --- a/app/src/util_android.cc +++ b/app/src/util_android.cc @@ -1882,18 +1882,15 @@ bool LogException(JNIEnv* env, LogLevel log_level, const char* log_fmt, ...) { } if (message) { std::string message_str = JniStringToString(env, message); - if (log_fmt == nullptr) { - LogMessage(log_level, "%s", message_str.c_str()); - } else { - static char buf[512]; + if (log_fmt != nullptr) { + char buf[512]; va_list list; va_start(list, log_fmt); - vsnprintf(buf, sizeof(buf) - 1, log_fmt, list); + vsnprintf(buf, sizeof(buf), log_fmt, list); va_end(list); - strncat(buf, ": ", sizeof(buf) - 1); - strncat(buf, message_str.c_str(), sizeof(buf) - 1); - LogMessage(log_level, "%s", buf); + message_str = std::string(buf) + ": " + message_str; } + LogMessage(log_level, "%s", message_str.c_str()); } env->DeleteLocalRef(exception); return true; diff --git a/release_build_files/readme.md b/release_build_files/readme.md index e1b9847c6e..c6e5cfe0e1 100644 --- a/release_build_files/readme.md +++ b/release_build_files/readme.md @@ -613,6 +613,11 @@ workflow use only during the development of your app, not for publicly shipping code. ## Release Notes +### Upcoming +- Changes + - General (Android): Fixed a potential buffer overflow in `LogException` when + formatting long JNI exception messages. + ### 14.1.0 - Changes - General (Android): Update to Firebase Android BoM version 35.1.0. From c36f4a4a9c8141dcaecbeaf1d083d280854296a7 Mon Sep 17 00:00:00 2001 From: austinbenoit Date: Mon, 26 Oct 2026 21:21:58 +0000 Subject: [PATCH 2/2] Zero-initialize stack buffer in LogException --- app/src/util_android.cc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/src/util_android.cc b/app/src/util_android.cc index d68f9b0124..506c086c37 100644 --- a/app/src/util_android.cc +++ b/app/src/util_android.cc @@ -1883,7 +1883,7 @@ bool LogException(JNIEnv* env, LogLevel log_level, const char* log_fmt, ...) { if (message) { std::string message_str = JniStringToString(env, message); if (log_fmt != nullptr) { - char buf[512]; + char buf[512] = {0}; va_list list; va_start(list, log_fmt); vsnprintf(buf, sizeof(buf), log_fmt, list);