From 46709aedc91b6077530941042664265cedc7f165 Mon Sep 17 00:00:00 2001 From: Walker Date: Wed, 13 May 2026 14:38:43 -0500 Subject: [PATCH 1/2] Part cFS/workflows#129, Use Updated Static Analysis Workflow --- .github/workflows/static-analysis.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/.github/workflows/static-analysis.yml b/.github/workflows/static-analysis.yml index 40c4cd9..37ba491 100644 --- a/.github/workflows/static-analysis.yml +++ b/.github/workflows/static-analysis.yml @@ -1,6 +1,5 @@ name: Static Analysis -# Run on all push and pull requests on: push: branches: @@ -17,4 +16,4 @@ jobs: static-analysis: name: Run cppcheck - uses: nasa/cFS/.github/workflows/static-analysis.yml@main + uses: nasa/cFS/.github/workflows/static-analysis-reusable.yml@dev From cb7d37acfbc3fd0d5aaad3e9a3f8c5c5b0cb8fa7 Mon Sep 17 00:00:00 2001 From: nurdmuny Date: Tue, 9 Jun 2026 06:06:40 -0700 Subject: [PATCH 2/2] GetSectionHeader: bound the section-name read loop MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The fgetc loop that reads a section name from the ELF section header string table into the fixed 60-byte VerboseStr[60] buffer had no upper bound on the loop index. An input ELF whose string table contains a section-name string longer than 60 bytes (no early '\0') overflows the stack buffer. The sibling loop in GetSymbol() (line 1971) reads a symbol name into the same buffer using the correct '(i < sizeof(VerboseStr))' bound; that bound was added in 75844867 (Fix #32, May 2020) but the same fix was never applied to the section-name loop a screen up. This applies the same fix shape — bound the loop, then explicitly nul-terminate after. --- elf2cfetbl.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/elf2cfetbl.c b/elf2cfetbl.c index b7f19e4..0c06f4b 100644 --- a/elf2cfetbl.c +++ b/elf2cfetbl.c @@ -1777,10 +1777,11 @@ int32 GetSectionHeader(int32 SectionIndex, union Elf_Shdr *SectionHeader) printf(" sh_name = 0x%08x - ", get_sh_name(SectionHeader)); fseek(SrcFileDesc, SeekOffset, SEEK_SET); - while ((VerboseStr[i] = fgetc(SrcFileDesc)) != '\0') + while ((i < sizeof(VerboseStr)) && ((VerboseStr[i] = fgetc(SrcFileDesc)) != '\0')) { i++; } + VerboseStr[i % sizeof(VerboseStr)] = '\0'; /* nul-terminate; see the GetSymbol() loop for the same fix shape */ if (Verbose) printf("%s\n", VerboseStr);