1369545 - address potentially unsafe snprintf usage in PrepareAcceptLanguages

Status: RESOLVED DUPLICATE of bug 1403802

(Core :: Networking, enhancement, P2)

Description

[Dana Keeler (she/her) (use needinfo) [:keeler]]

snprintf returns the number of bytes it *would have* written when it runs out of buffer space. PrepareAcceptLanguages uses the return value from snprintf without checking this. It looks like in practice this code can't overflow the buffer (and it comes from a user pref anyway (as opposed to content, which would be concerning), from what I can tell), but we should actually do the check and better future-proof this code.

Comment 1

[Gerry Chang [:gchang]]

Track 53-/54- as we've build 54 RC and there is not security level here. Feel free to nominate again if the security level is critical/high.

Comment 2

[Julien Cristau [:jcristau]]

tracking for 55.

Comment 3

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

This is a sec-low that doesn't need to be tracked for 55. In 55, we are already tracking several sec-high/sec-crits. If there is a fix ready for this one and deemed low risk, please nominate for uplift to Beta.

Comment 4

[Honza Bambas (:mayhemer)]

Potential sec bug that I don't want to backlog just that.  PrepareAcceptLanguages is a candidate to rewrite with Tokenizer and an encapsulated string buffer (ns*CString), tho.

Comment 5

[Valentin Gosu [:valentin] (he/him)]

This was fixed in bug 1403802 by rewriting the method in rust.