Merge pull request #377 from runloopai/adam/fix-buffer-overflow-sha256

liulanzheng · web-flow · commit 6e1bd7b7cf9c · 2025-08-18T16:51:49.000+08:00
Fix buffer-overflow in sha256 string construction
diff --git a/src/tools/sha256file.cpp b/src/tools/sha256file.cpp
@@ -103,7 +103,7 @@ string sha256sum(const char *fn) {
         }
     }
     SHA256_Final(sha, &ctx);
-    char res[SHA256_DIGEST_LENGTH * 2];
+    char res[SHA256_DIGEST_LENGTH * 2 + 1];
     for (int i = 0; i < SHA256_DIGEST_LENGTH; i++)
         sprintf(res + (i * 2), "%02x", sha[i]);
     return "sha256:" + std::string(res, SHA256_DIGEST_LENGTH * 2);

Original file line number	Diff line number	Diff line change
`@@ -103,7 +103,7 @@ string sha256sum(const char *fn) {`
`103`	`103`	`}`
`104`	`104`	`}`
`105`	`105`	`SHA256_Final(sha, &ctx);`
`106`		`- char res[SHA256_DIGEST_LENGTH * 2];`
	`106`	`+ char res[SHA256_DIGEST_LENGTH * 2 + 1];`
`107`	`107`	`for (int i = 0; i < SHA256_DIGEST_LENGTH; i++)`
`108`	`108`	`sprintf(res + (i * 2), "%02x", sha[i]);`
`109`	`109`	`return "sha256:" + std::string(res, SHA256_DIGEST_LENGTH * 2);`