Skip to content

Fix buffer overflows, null pointer dereferences, and unsafe string ops in libdmg#3

Draft
Copilot wants to merge 2 commits intomasterfrom
copilot/search-for-project-issues
Draft

Fix buffer overflows, null pointer dereferences, and unsafe string ops in libdmg#3
Copilot wants to merge 2 commits intomasterfrom
copilot/search-for-project-issues

Conversation

Copy link
Copy Markdown

Copilot AI commented Apr 4, 2026

Several memory safety bugs in the DMG parsing and writing paths that could cause crashes on malformed input or buffer overflows on unbounded string operations.

Changes

Buffer overflow (abstractfile.c)

  • vsprintf into a fixed 1024-byte stack buffer → vsnprintf with bounds

NULL pointer dereferences

All cases follow the same pattern: getResourceByKey(...) can return NULL but the result was immediately dereferenced without a check.

  • dmgfile.copenDmgFile: Gracefully return NULL (with resource cleanup) if "blkx" key is absent
  • resources.creadNSiz: Return NULL if "nsiz" key is absent
  • resources.cgetDataByID: Added NULL guard on the resource parameter itself
  • partition.creadApplePartitionMap: Chained getResourceByKey + getDataByID with no checks on either
  • dmglib.c: Three functions (extractDmg, calculateMasterChecksum, convertToISO) all directly dereferenced getResourceByKey results

Unsafe strcpy of caller-supplied string (partition.c)

createApplePartitionMap used strcpy to write volumeType into a fixed 32-byte pmParType field:

// Before — unchecked copy of caller-supplied string
strcpy((char*)partition[0].pmParType, volumeType);

// After — bounded copy with explicit null termination
strncpy((char*)partition[0].pmParType, volumeType, sizeof(partition[0].pmParType) - 1);
partition[0].pmParType[sizeof(partition[0].pmParType) - 1] = '\0';

Debug information leak (partition.c)

Removed a leftover printf in writeATAPI that printed the internal malloc address and allocation size of a buffer.

Original prompt

Search for any issues in this project

Copilot AI changed the title [WIP] Search for issues in the project Fix buffer overflows, null pointer dereferences, and unsafe string ops in libdmg Apr 4, 2026
Copilot AI requested a review from posixninja April 4, 2026 19:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants