Repository navigation
Conversation
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Proposed Changes
The binary restart readers copy a user-controlled filename into a fixed
char fname[100]withstrcpy, which has no bounds check. The filename comes from the config (SOLUTION_FILENAMEand thederived restart/mesh names), so a path longer than 99 characters overflows the stack buffer.
This replaces the fixed buffer and
strcpywith aconst char* fname = <filename>.c_str();at eachsite. The string is already in scope and is not modified between this point and the file open, so the
behaviour is identical; only the fixed-size copy is removed. All use sites (
fopen,MPI_File_open,and the error messages) are unchanged.
Sites fixed (all were
char fname[100]):CSolver::Read_SU2_Restart_ASCIIandCSolver::Read_SU2_Restart_BinaryCBaselineSolver::Load_Restart(binary and ASCII branches)CBaselineSolver_FEM::Load_Restart(binary and ASCII branches)CPhysicalGeometry::SetBoundariesrestart readers (binary and ASCII branches)Verification
SOLUTION_FILENAMEat a ~150-character path aborts with a stack-buffer-overflow inRead_SU2_Restart_Binary(the write intofname). After the change the same case runs cleanlyunder ASAN.
axi_rans_air_nozzle_restart(reads a binary restart) reproduces the stored regression valuesexactly, confirming the readers are unaffected. The change is non-numerical, so no regression
values change.
There is one related spot left out of this PR to keep it focused: the surface-sensitivity reader in
CPhysicalGeometryusescstr[MAX_STRING_SIZE]withstrcpy/strcat(400 bytes, a differentfunction). Happy to address it here or in a follow-up, whichever is preferred.
Related Work
None.
PR Checklist
pre-commit run --allto format old commits.