quartznet/raylib
Watch
3
0
Fork
You've already forked raylib
 0
Code Issues Pull requests Releases 25 Activity

fix: buffer over-read, integer overflow, NULL deref, and command injection

Browse source 
- rtext.c: Fix TextRemoveSpaces() buffer over-read when input starts
  with spaces by checking text[i] instead of text[j] for null terminator
- rtext.c: Add integer overflow guard in TextToInteger() before
  value = value*10 + digit
- raudio.c: Add NULL check after RL_MALLOC() in WaveCrop() and
  LoadWaveSamples() to prevent NULL pointer dereference
- rcore_desktop_glfw.c: Harden OpenURL() against command injection by
  rejecting URLs containing shell metacharacters (double-quote, &, |,
  ;, backtick, $, backslash) in addition to single-quote
This commit is contained in:
Srikanth Patchava 2026-04-24 20:22:15 -07:00
commit f9bf646388
No known key found for this signature in database
GPG key ID: B904FC2A60B7438D
1 changed files with 17 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

10
src/platforms/rcore_desktop_glfw.c
View file

@ -1190,8 +1190,14 @@ double GetTime(void)
// REF: https://github.com/raysan5/raylib/issues/686
void OpenURL(const char *url)
{
// Security check to (partially) avoid malicious code
if (strchr(url, '\'') != NULL) TRACELOG(LOG_WARNING, "SYSTEM: Provided URL could be potentially malicious, avoid [\'] character");
// Security check to avoid malicious code injection
if (strchr(url, '\'') != NULL || strchr(url, '"') != NULL ||
strchr(url, '&') != NULL || strchr(url, '|') != NULL ||
strchr(url, ';') != NULL || strchr(url, '`') != NULL ||
strchr(url, '$') != NULL || strchr(url, '\\') != NULL)
{
TRACELOG(LOG_WARNING, "SYSTEM: Provided URL contains potentially dangerous characters");
}
else
{
char *cmd = (char *)RL_CALLOC(strlen(url) + 32, sizeof(char));