Just looked quickly a bit ...

I spotted some sprintf() which are unsafe, especially when dealing with DB string or blobs, the target buffer is 255 bytes in size, but I haven't seen any check of input size.

This snippet needs some checks as well, for allocated pointer and snprintf:

+			int username_size=VAL_STR(tval).len+1*sizeof(char);
+			username = (char*)pkg_malloc(username_size);
+			snprintf(username,username_size,"%s",VAL_STR(tval).s);

pkg_strdup() can return NULL, but that is not checked -- although, I didn't looked more to see if it always safe to work further if the return is NULL there.

I will ask to see if anyone else can do additional work to review. If not, as I said, I do not have anything against merging it.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.