From 85e3e8c6bee43fc8e9ef3f98282d3c2cd3d8d53a Mon Sep 17 00:00:00 2001 From: Devon Kirk Date: Mon, 29 Jun 2026 21:55:34 -0400 Subject: [PATCH] fix: replace strcpy with g_strlcpy for module_name in sidebar main_display_verse_list_in_sidebar() copies module_name into two fixed 80-byte buffers (settings.sb_search_mod[80] and sidebar.mod_name[80]) using strcpy() with no bounds check. When BibleSync navigation takes the indirect path (unknown module, multi-ref, or user preference), the bible field from the UDP packet is passed directly as module_name at biblesync_glue.cc:184. A bible field exceeding 80 bytes overflows both global buffers. Replace strcpy with g_strlcpy, which always null-terminates and never writes more than the specified buffer size. --- src/main/sidebar.cc | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/main/sidebar.cc b/src/main/sidebar.cc index b2911c1d8..610c97a85 100644 --- a/src/main/sidebar.cc +++ b/src/main/sidebar.cc @@ -165,14 +165,16 @@ void main_display_verse_list_in_sidebar(gchar *key, list_of_verses = NULL; } - strcpy(settings.sb_search_mod, module_name); + g_strlcpy(settings.sb_search_mod, module_name, + sizeof(settings.sb_search_mod)); model = gtk_tree_view_get_model(GTK_TREE_VIEW(sidebar.results_list)); list_store = GTK_LIST_STORE(model); gtk_list_store_clear(list_store); - strcpy(sidebar.mod_name, module_name); + g_strlcpy(sidebar.mod_name, module_name, + sizeof(sidebar.mod_name)); if (!strncmp(verse_list, "See ", 4)) verse_list += 4;