From daa2921476fbc98ed45305182e9bae225f4e08ab Mon Sep 17 00:00:00 2001 From: MykBamberg Date: Wed, 12 Mar 2025 01:38:39 +0100 Subject: [PATCH 1/3] [rcore] Use snprintf to prevent buffer overflow in path construction --- src/rcore.c | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) diff --git a/src/rcore.c b/src/rcore.c index 6739e5f05..4d632e997 100644 --- a/src/rcore.c +++ b/src/rcore.c @@ -3688,12 +3688,16 @@ static void ScanDirectoryFiles(const char *basePath, FilePathList *files, const (strcmp(dp->d_name, "..") != 0)) { #if defined(_WIN32) - sprintf(path, "%s\\%s", basePath, dp->d_name); + int realPathLength = snprintf(path, sizeof(path) - 1, "%s\\%s", basePath, dp->d_name); #else - sprintf(path, "%s/%s", basePath, dp->d_name); + int realPathLength = snprintf(path, sizeof(path) - 1, "%s/%s", basePath, dp->d_name); #endif - if (filter != NULL) + if (realPathLength < 0 || realPathLength >= sizeof(path)) + { + TRACELOG(LOG_WARNING, "FILEIO: Path longer than %d characters (%s...)", MAX_FILEPATH_LENGTH, basePath); + } + else if (filter != NULL) { if (IsPathFile(path)) { @@ -3742,12 +3746,16 @@ static void ScanDirectoryFilesRecursively(const char *basePath, FilePathList *fi { // Construct new path from our base path #if defined(_WIN32) - sprintf(path, "%s\\%s", basePath, dp->d_name); + int realPathLength = snprintf(path, sizeof(path) - 1, "%s\\%s", basePath, dp->d_name); #else - sprintf(path, "%s/%s", basePath, dp->d_name); + int realPathLength = snprintf(path, sizeof(path) - 1, "%s/%s", basePath, dp->d_name); #endif - if (IsPathFile(path)) + if (realPathLength < 0 || realPathLength >= sizeof(path)) + { + TRACELOG(LOG_WARNING, "FILEIO: Path longer than %d characters (%s...)", MAX_FILEPATH_LENGTH, basePath); + } + else if (IsPathFile(path)) { if (filter != NULL) { From fffbbad2f7fd0fdfdafdf291c732249cedfa3d4d Mon Sep 17 00:00:00 2001 From: Nia Nightglow Date: Wed, 12 Mar 2025 00:00:18 -0500 Subject: [PATCH 2/3] Guard against DEBUG Redefinition Undefine DEBUG to avoid external redefinition warnings/conflicts. This is probably a common definition for many external build systems' debug configurations. This ensures raylib will not emit a warning about the DEBUG definition being redefined in external build systems. --- src/external/jar_xm.h | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/src/external/jar_xm.h b/src/external/jar_xm.h index b5e80e48a..174c1704c 100644 --- a/src/external/jar_xm.h +++ b/src/external/jar_xm.h @@ -232,6 +232,13 @@ uint64_t jar_xm_get_remaining_samples(jar_xm_context_t* ctx); #include #include +#ifdef DEBUG + // Undefine DEBUG to avoid external redefinition warnings/conflicts + // This is probably a common definition for + // many external build systems' debug configurations + #undef DEBUG +#endif + #if JAR_XM_DEBUG //JAR_XM_DEBUG defined as 0 #include #define DEBUG(fmt, ...) do { \ From 749a512f13aaa0d8522a6cccd038569efe91c5cc Mon Sep 17 00:00:00 2001 From: Ray Date: Wed, 12 Mar 2025 12:44:40 +0100 Subject: [PATCH 3/3] REVIEWED: `ScanDirectoryFiles*()` #4833 --- src/rcore.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/src/rcore.c b/src/rcore.c index 4d632e997..6c5bc2518 100644 --- a/src/rcore.c +++ b/src/rcore.c @@ -3688,12 +3688,12 @@ static void ScanDirectoryFiles(const char *basePath, FilePathList *files, const (strcmp(dp->d_name, "..") != 0)) { #if defined(_WIN32) - int realPathLength = snprintf(path, sizeof(path) - 1, "%s\\%s", basePath, dp->d_name); + int pathLength = snprintf(path, MAX_FILEPATH_LENGTH - 1, "%s\\%s", basePath, dp->d_name); #else - int realPathLength = snprintf(path, sizeof(path) - 1, "%s/%s", basePath, dp->d_name); + int pathLength = snprintf(path, MAX_FILEPATH_LENGTH - 1, "%s/%s", basePath, dp->d_name); #endif - if (realPathLength < 0 || realPathLength >= sizeof(path)) + if ((pathLength < 0) || (pathLength >= MAX_FILEPATH_LENGTH)) { TRACELOG(LOG_WARNING, "FILEIO: Path longer than %d characters (%s...)", MAX_FILEPATH_LENGTH, basePath); } @@ -3746,12 +3746,12 @@ static void ScanDirectoryFilesRecursively(const char *basePath, FilePathList *fi { // Construct new path from our base path #if defined(_WIN32) - int realPathLength = snprintf(path, sizeof(path) - 1, "%s\\%s", basePath, dp->d_name); + int pathLength = snprintf(path, MAX_FILEPATH_LENGTH - 1, "%s\\%s", basePath, dp->d_name); #else - int realPathLength = snprintf(path, sizeof(path) - 1, "%s/%s", basePath, dp->d_name); + int pathLength = snprintf(path, MAX_FILEPATH_LENGTH - 1, "%s/%s", basePath, dp->d_name); #endif - if (realPathLength < 0 || realPathLength >= sizeof(path)) + if ((pathLength < 0) || (pathLength >= MAX_FILEPATH_LENGTH)) { TRACELOG(LOG_WARNING, "FILEIO: Path longer than %d characters (%s...)", MAX_FILEPATH_LENGTH, basePath); }