Skip to content

Commit 43f6477

Browse files
Security AuditLibretroAdmin
authored andcommitted
Fix buffer overflow vulnerabilities in ai/game_ai.c
Replace unsafe strcpy/strcat calls with safe strlcpy/strlcat to prevent buffer overflow attacks. The original code could overflow the 1024-byte buffers if input strings were too long. Security impact: - Prevents potential arbitrary code execution via buffer overflow - Adds proper length validation for constructed file paths - Uses RetroArch's existing safe string functions consistently Affected functions: - game_ai_load(): Fixed g_game_name buffer overflow - game_ai_think(): Fixed data_path construction overflow
1 parent f2e32f0 commit 43f6477

1 file changed

Lines changed: 8 additions & 4 deletions

File tree

ai/game_ai.c

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -150,7 +150,7 @@ void game_ai_shutdown(void)
150150

151151
void game_ai_load(const char * name, void * ram_ptr, int ram_size, retro_log_printf_t log)
152152
{
153-
strcpy((char *) &g_game_name[0], name);
153+
strlcpy(g_game_name, name, sizeof(g_game_name));
154154

155155
g_ram_ptr = ram_ptr;
156156
g_ram_size = ram_size;
@@ -179,9 +179,13 @@ void game_ai_think(bool override_p1, bool override_p2, bool show_debug,
179179
if (ga)
180180
{
181181
char data_path[1024] = {0};
182-
strcpy(&data_path[0], (char *)game_ai_lib_path);
183-
strcat(&data_path[0], "/data/");
184-
strcat(&data_path[0], (char *)g_game_name);
182+
183+
/* Build path safely with proper length checking */
184+
strlcpy(data_path, game_ai_lib_path, sizeof(data_path));
185+
strlcat(data_path, "/data/", sizeof(data_path));
186+
strlcat(data_path, g_game_name, sizeof(data_path));
187+
if (strlen(data_path) >= sizeof(data_path) - 1)
188+
return; /* Path too long, abort safely */
185189

186190
game_ai_lib_init(ga, (void *) g_ram_ptr, g_ram_size);
187191
game_ai_lib_set_debug_log(ga, game_ai_debug_log);

0 commit comments

Comments
 (0)