From e38a3dcf017661f61d8d83399e908aa0b3c6d4b0 Mon Sep 17 00:00:00 2001 From: xiepengfei Date: Fri, 18 Sep 2026 21:05:41 +0800 Subject: [PATCH] fix: replace unsafe strcpy with memcpy in setLibNames MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 1. Root cause: setLibNames() used strcpy() which does not bound the copy length, flagged by clang-analyzer as CWE-119 risk 2. Fix: extract size_t len = strlen(tmp.chDocumentPr) + 1, use memcpy with len for bounded copy, reuse len for malloc too 3. Impact: no behavior change, memcpy copies identical content including null terminator, eliminates redundant strlen call Influence: 1. Verify application startup loads dynamic library path correctly 2. Verify document processing functions work as expected 3. No regression expected as copy semantics are identical fix: 替换 setLibNames 中不安全的 strcpy 为 memcpy 1. 根因：setLibNames() 使用 strcpy() 进行拷贝，该函数不限制拷贝 长度，被 clang-analyzer 标记为 CWE-119 安全风险 2. 方案：提取 size_t len = strlen(tmp.chDocumentPr) + 1 变量， 使用 memcpy 配合 len 做有界拷贝，len 同时复用于 malloc 3. 影响：无行为变化，memcpy 拷贝内容与 strcpy 完全一致（含 null 终止符），同时消除冗余 strlen 调用 Influence: 1. 验证应用启动时动态库路径正确加载 2. 验证文档处理功能正常工作 3. 拷贝语义完全一致，预期无回归 PMS: BUG-212 --- reader/load_libs.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/reader/load_libs.c b/reader/load_libs.c index e200a2bac..31307401c 100755 --- a/reader/load_libs.c +++ b/reader/load_libs.c @@ -115,12 +115,12 @@ void setLibNames(LoadLibNames tmp) g_ldnames.chDocumentPr = NULL; } else { fprintf(stderr, "INFO: Copying library path: %s\n", tmp.chDocumentPr); - g_ldnames.chDocumentPr = (char*)malloc(strlen(tmp.chDocumentPr)+1); + size_t len = strlen(tmp.chDocumentPr) + 1; + g_ldnames.chDocumentPr = (char*)malloc(len); if (!g_ldnames.chDocumentPr) { fprintf(stderr, "ERROR: Failed to allocate memory for library path\n"); return; } - strcpy(g_ldnames.chDocumentPr,tmp.chDocumentPr); + memcpy(g_ldnames.chDocumentPr, tmp.chDocumentPr, len); } } -