security: Round 5.1 scanf %s limit (U02)

U02: Limit %s to 255 chars in scanf/sscanf/fscanf to prevent buffer overflow
- Added check (i < 255) in %s parsing loop for scanf
- Added check (i < 255) in %s parsing loop for sscanf
- Added check (i < 255) in %s parsing loop for fscanf

Tests: 119/119 PASS (smoke test, SMP=4)

diff --git a/user/ulibc/src/stdio.c b/user/ulibc/src/stdio.c
index 8660f4b7a795dfb7f8f842c4f0e6b6e5748d8a89..34109fb37248715ee3ae75023db1a3e16fb00d88 100644 (file)
--- a/user/ulibc/src/stdio.c
+++ b/user/ulibc/src/stdio.c
@@ -405,6 +405,7 @@ int snprintf(char* buf, size_t size, const char* fmt, ...) {
 
 int sscanf(const char* str, const char* fmt, ...) {
     /* Minimal sscanf: only supports %d and %s */
+    /* U02: %s limited to 255 chars by default to prevent buffer overflow */
     va_list ap;
     va_start(ap, fmt);
     int count = 0;
@@ -430,7 +431,7 @@ int sscanf(const char* str, const char* fmt, ...) {
                 char* out = va_arg(ap, char*);
                 while (*s == ' ') s++;
                 int i = 0;
-                while (*s && *s != ' ' && *s != '\n' && *s != '\t') out[i++] = *s++;
+                while (*s && *s != ' ' && *s != '\n' && *s != '\t' && i < 255) out[i++] = *s++;
                 out[i] = '\0';
                 count++;
             } else {
@@ -606,6 +607,7 @@ char* tmpnam(char* s) {
 
 int fscanf(FILE* fp, const char* fmt, ...) {
     /* Read a line, then delegate to sscanf */
+    /* U02: %s limited to 255 chars by default to prevent buffer overflow */
     char line[512];
     if (!fgets(line, (int)sizeof(line), fp)) return EOF;
     va_list ap;
@@ -635,7 +637,7 @@ int fscanf(FILE* fp, const char* fmt, ...) {
                 char* out = va_arg(ap, char*);
                 while (*s == ' ') s++;
                 int i = 0;
-                while (*s && *s != ' ' && *s != '\n' && *s != '\t') out[i++] = *s++;
+                while (*s && *s != ' ' && *s != '\n' && *s != '\t' && i < 255) out[i++] = *s++;
                 out[i] = '\0';
                 count++;
             } else if (*f == 'c') {
@@ -659,6 +661,7 @@ int fscanf(FILE* fp, const char* fmt, ...) {
 }
 
 int scanf(const char* fmt, ...) {
+    /* U02: %s limited to 255 chars by default to prevent buffer overflow */
     char line[512];
     if (!fgets(line, (int)sizeof(line), stdin)) return EOF;
     va_list ap;
@@ -686,7 +689,7 @@ int scanf(const char* fmt, ...) {
                 char* out = va_arg(ap, char*);
                 while (*s == ' ') s++;
                 int i = 0;
-                while (*s && *s != ' ' && *s != '\n' && *s != '\t') out[i++] = *s++;
+                while (*s && *s != ' ' && *s != '\n' && *s != '\t' && i < 255) out[i++] = *s++;
                 out[i] = '\0';
                 count++;
             } else {