CVE-2018-7186: Out-of-bounds Write (CWE-787)
value: Leptonica before 1.75.3 does not limit the number of characters in a %s format argument to fscanf or sscanf, which allows remote attackers to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a long string, as demonstrated by the gplotRead and ptaReadStream functions.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2018-02-16T16:29Z
Repository: https://github.com/DanBloomberg/leptonica
Language: C
Files changed: README.md, prog/xtractprotos.c, src/gplot.c, src/ptabasic.c, src/sel1.c
Commit date: 2018-02-15 15:19:04 -0800
Commit message: Security fixes: expect final changes for release 1.75.3.
* Fixed a debian security issue with fscanf() reading a string with
  possible buffer overflow.
* There were also a few similar situations with sscanf().

Diff: diff --git a/README.md b/README.md
index 5f0d84f..527a5ff 100644
--- a/README.md
+++ b/README.md
@@ -61,13 +61,14 @@ www.leptonica.org
   * _Documentation_: large number of in-line comments; doxygen; web pages for further background
   * _Examples_: many programs provided to test and show usage of approx. 2600 functions in the library
 
 
 ## Open Source Projects that use Leptonica ##
-  * [php](http://en.wikipedia.org/wiki/PHP)  (scripting language for dynamic web pages)
   * [tesseract](https://github.com/tesseract-ocr/tesseract/) (optical character recognition)
+  * [OpenCV](https://github.com/opencv/opencv) (computer vision library)
   * [jbig2enc](http://www.imperialviolet.org/jbig2.html) (encodes multipage binary image documents with jbig2 compression)
+  * [php](http://en.wikipedia.org/wiki/PHP)  (scripting language for dynamic web pages)
 
 ## Major contributors to Leptonica ##
   * Tom Powers: Tom has supported Leptonica on Windows for many years.  He has made many contributions to code quality and documentation, including the beautiful "unofficial documentation" on the web site. Without his effort, Leptonica would not run today on Windows.
   * David Bryan: David has worked for years to support Leptonica on multiple platforms. He designed many nice features in Leptonica, such as the severity-based error messaging system, and has identified and fixed countless bugs. And he has built and tested each distribution many times on cross-compilers.
   * James Le Cuirot: James has written and supported the autotools scripts on Leptonica distributions for many years, and has helped test every distribution since 1.67.
diff --git a/prog/xtractprotos.c b/prog/xtractprotos.c
index b6689a7..3092074 100644
--- a/prog/xtractprotos.c
+++ b/prog/xtractprotos.c
@@ -85,20 +85,20 @@
  */
 
 #include <string.h>
 #include "allheaders.h"
 
-static const l_int32  L_BUF_SIZE = 512;
+static const l_int32  L_BUFSIZE = 512;  /* hardcoded below in sscanf() */
 static const char *version = "1.5";
 
 
 int main(int    argc,
          char **argv)
 {
 char        *filein, *str, *tempfile, *prestring, *outprotos, *protostr;
 const char  *spacestr = " ";
-char         buf[L_BUF_SIZE];
+char         buf[L_BUFSIZE];
 l_uint8     *allheaders;
 l_int32      i, maxindex, in_line, nflags, protos_added, firstfile, len, ret;
 size_t       nbytes;
 L_BYTEA     *ba, *ba2;
 SARRAY      *sa, *safirst;
@@ -123,25 +123,25 @@ static char  mainName[] = "xtractprotos";
     maxindex = L_MIN(3, argc);
     for (i = 1; i < maxindex; i++) {
         if (argv[i][0] == '-') {
             if (!strncmp(argv[i], "-prestring", 10)) {
                 nflags++;
-                ret = sscanf(argv[i] + 1, "prestring=%s", buf);
+                ret = sscanf(argv[i] + 1, "prestring=%490s", buf);
                 if (ret != 1) {
                     fprintf(stderr, "parse failure for prestring\n");
                     return 1;
                 }
-                if ((len = strlen(buf)) > L_BUF_SIZE - 3) {
+                if ((len = strlen(buf)) > L_BUFSIZE - 3) {
                     L_WARNING("prestring too large; omitting!\n", mainName);
                 } else {
                     buf[len] = ' ';
                     buf[len + 1] = '\0';
                     prestring = stringNew(buf);
                 }
             } else if (!strncmp(argv[i], "-protos", 7)) {
                 nflags++;
-                ret = sscanf(argv[i] + 1, "protos=%s", buf);
+                ret = sscanf(argv[i] + 1, "protos=%490s", buf);
                 if (ret != 1) {
                     fprintf(stderr, "parse failure for protos\n");
                     return 1;
                 }
                 outprotos = stringNew(buf);
@@ -163,11 +163,11 @@ static char  mainName[] = "xtractprotos";
     ba = l_byteaCreate(500);
 
         /* First the extern C head */
     sa = sarrayCreate(0);
     sarrayAddString(sa, (char *)"/*", L_COPY);
-    snprintf(buf, L_BUF_SIZE,
+    snprintf(buf, L_BUFSIZE,
              " *  These prototypes were autogen'd by xtractprotos, v. %s",
              version);
     sarrayAddString(sa, buf, L_COPY);
     sarrayAddString(sa, (char *)" */", L_COPY);
     sarrayAddString(sa, (char *)"#ifdef __cplusplus", L_COPY);
@@ -188,11 +188,11 @@ static char  mainName[] = "xtractprotos";
     for (i = firstfile; i < argc; i++) {
         filein = argv[i];
         len = strlen(filein);
         if (filein[len - 1] == 'h')  /* skip .h files */
             continue;
-        snprintf(buf, L_BUF_SIZE, "cpp -ansi -DNO_PROTOS %s %s",
+        snprintf(buf, L_BUFSIZE, "cpp -ansi -DNO_PROTOS %s %s",
                  filein, tempfile);
         ret = system(buf);  /* cpp */
         if (ret) {
             fprintf(stderr, "cpp failure for %s; continuing\n", filein);
             continue;
diff --git a/src/gplot.c b/src/gplot.c
index 561147a..901d5f1 100644
--- a/src/gplot.c
+++ b/src/gplot.c
@@ -48,13 +48,13 @@
  *     Serialize for I/O
  *          GPLOT      *gplotRead()
  *          l_int32     gplotWrite()
  *
  *
- *     Utility for programmatic plotting using gnuplot 7.3.2 or later
+ *     Utility for programmatic plotting using gnuplot 4.6 or later
  *     Enabled:
- *         ~ output to png (color), ps (mono), x11 (color), latex (mono)
+ *         ~ output to png (color), ps and eps (mono), latex (mono)
  *         ~ optional title for graph
  *         ~ optional x and y axis labels
  *         ~ multiple plots on one frame
  *         ~ optional title for each plot on the frame
  *         ~ optional log scaling on either or both axes
@@ -98,11 +98,11 @@
  */
 
 #include <string.h>
 #include "allheaders.h"
 
-static const l_int32  L_BUF_SIZE = 512;
+static const l_int32  L_BUFSIZE = 512;  /* hardcoded below in fscanf */
 
 const char  *gplotstylenames[] = {"with lines",
                                   "with points",
                                   "with impulses",
                                   "with linespoints",
@@ -140,11 +140,11 @@ gplotCreate(const char  *rootname,
             const char  *title,
             const char  *xlabel,
             const char  *ylabel)
 {
 char    *newroot;
-char     buf[L_BUF_SIZE];
+char     buf[L_BUFSIZE];
 l_int32  badchar;
 GPLOT   *gplot;
 
     PROCNAME("gplotCreate");
 
@@ -167,20 +167,20 @@ GPLOT   *gplot;
 
         /* Save title, labels, rootname, outformat, cmdname, outname */
     newroot = genPathname(rootname, NULL);
     gplot->rootname = newroot;
     gplot->outformat = outformat;
-    snprintf(buf, L_BUF_SIZE, "%s.cmd", rootname);
+    snprintf(buf, L_BUFSIZE, "%s.cmd", rootname);
     gplot->cmdname = stringNew(buf);
     if (outformat == GPLOT_PNG)
-        snprintf(buf, L_BUF_SIZE, "%s.png", newroot);
+        snprintf(buf, L_BUFSIZE, "%s.png", newroot);
     else if (outformat == GPLOT_PS)
-        snprintf(buf, L_BUF_SIZE, "%s.ps", newroot);
+        snprintf(buf, L_BUFSIZE, "%s.ps", newroot);
     else if (outformat == GPLOT_EPS)
-        snprintf(buf, L_BUF_SIZE, "%s.eps", newroot);
+        snprintf(buf, L_BUFSIZE, "%s.eps", newroot);
     else if (outformat == GPLOT_LATEX)
-        snprintf(buf, L_BUF_SIZE, "%s.tex", newroot);
+        snprintf(buf, L_BUFSIZE, "%s.tex", newroot);
     gplot->outname = stringNew(buf);
     if (title) gplot->title = stringNew(title);
     if (xlabel) gplot->xlabel = stringNew(xlabel);
     if (ylabel) gplot->ylabel = stringNew(ylabel);
 
@@ -264,11 +264,11 @@ gplotAddPlot(GPLOT       *gplot,
              NUMA        *nax,
              NUMA        *nay,
              l_int32      plotstyle,
              const char  *plottitle)
 {
-char       buf[L_BUF_SIZE];
+char       buf[L_BUFSIZE];
 char       emptystring[] = "";
 char      *datastr, *title;
 l_int32    n, i;
 l_float32  valx, valy, startx, delx;
 SARRAY    *sa;
@@ -301,22 +301,22 @@ SARRAY    *sa;
         sarrayAddString(gplot->plottitles, emptystring, L_COPY);
     }
 
         /* Generate and save data filename */
     gplot->nplots++;
-    snprintf(buf, L_BUF_SIZE, "%s.data.%d", gplot->rootname, gplot->nplots);
+    snprintf(buf, L_BUFSIZE, "%s.data.%d", gplot->rootname, gplot->nplots);
     sarrayAddString(gplot->datanames, buf, L_COPY);
 
         /* Generate data and save as a string */
     sa = sarrayCreate(n);
     for (i = 0; i < n; i++) {
         if (nax)
             numaGetFValue(nax, i, &valx);
         else
             valx = startx + i * delx;
         numaGetFValue(nay, i, &valy);
-        snprintf(buf, L_BUF_SIZE, "%f %f\n", valx, valy);
+        snprintf(buf, L_BUFSIZE, "%f %f\n", valx, valy);
         sarrayAddString(sa, buf, L_COPY);
     }
     datastr = sarrayToString(sa, 0);
     sarrayAddString(gplot->plotdata, datastr, L_INSERT);
     sarrayDestroy(&sa);
@@ -376,11 +376,11 @@ gplotSetScaling(GPLOT   *gplot,
  * </pre>
  */
 l_int32
 gplotMakeOutput(GPLOT  *gplot)
 {
-char     buf[L_BUF_SIZE];
+char     buf[L_BUFSIZE];
 char    *cmdname;
 l_int32  ignore;
 
     PROCNAME("gplotMakeOutput");
 
@@ -390,13 +390,13 @@ l_int32  ignore;
     gplotGenCommandFile(gplot);
     gplotGenDataFiles(gplot);
     cmdname = genPathname(gplot->cmdname, NULL);
 
 #ifndef _WIN32
-    snprintf(buf, L_BUF_SIZE, "gnuplot %s", cmdname);
+    snprintf(buf, L_BUFSIZE, "gnuplot %s", cmdname);
 #else
-    snprintf(buf, L_BUF_SIZE, "wgnuplot %s", cmdname);
+    snprintf(buf, L_BUFSIZE, "wgnuplot %s", cmdname);
 #endif  /* _WIN32 */
 
 #ifndef OS_IOS /* iOS 11 does not support system() */
     ignore = system(buf);  /* gnuplot || wgnuplot */
 #endif /* !OS_IOS */
@@ -413,11 +413,11 @@ l_int32  ignore;
  * \return  0 if OK, 1 on error
  */
 l_int32
 gplotGenCommandFile(GPLOT  *gplot)
 {
-char     buf[L_BUF_SIZE];
+char     buf[L_BUFSIZE];
 char    *cmdstr, *plottitle, *dataname;
 l_int32  i, plotstyle, nplots;
 FILE    *fp;
 
     PROCNAME("gplotGenCommandFile");
@@ -428,67 +428,67 @@ FILE    *fp;
         /* Remove any previous command data */
     sarrayClear(gplot->cmddata);
 
         /* Generate command data instructions */
     if (gplot->title) {   /* set title */
-        snprintf(buf, L_BUF_SIZE, "set title '%s'", gplot->title);
+        snprintf(buf, L_BUFSIZE, "set title '%s'", gplot->title);
         sarrayAddString(gplot->cmddata, buf, L_COPY);
     }
     if (gplot->xlabel) {   /* set xlabel */
-        snprintf(buf, L_BUF_SIZE, "set xlabel '%s'", gplot->xlabel);
+        snprintf(buf, L_BUFSIZE, "set xlabel '%s'", gplot->xlabel);
         sarrayAddString(gplot->cmddata, buf, L_COPY);
     }
     if (gplot->ylabel) {   /* set ylabel */
-        snprintf(buf, L_BUF_SIZE, "set ylabel '%s'", gplot->ylabel);
+        snprintf(buf, L_BUFSIZE, "set ylabel '%s'", gplot->ylabel);
         sarrayAddString(gplot->cmddata, buf, L_COPY);
     }
 
         /* Set terminal type and output */
     if (gplot->outformat == GPLOT_PNG) {
-        snprintf(buf, L_BUF_SIZE, "set terminal png; set output '%s'",
+        snprintf(buf, L_BUFSIZE, "set terminal png; set output '%s'",
                  gplot->outname);
     } else if (gplot->outformat == GPLOT_PS) {
-        snprintf(buf, L_BUF_SIZE, "set terminal postscript; set output '%s'",
+        snprintf(buf, L_BUFSIZE, "set terminal postscript; set output '%s'",
                  gplot->outname);
     } else if (gplot->outformat == GPLOT_EPS) {
-        snprintf(buf, L_BUF_SIZE,
+        snprintf(buf, L_BUFSIZE,
                  "set terminal postscript eps; set output '%s'",
                  gplot->outname);
     } else if (gplot->outformat == GPLOT_LATEX) {
-        snprintf(buf, L_BUF_SIZE, "set terminal latex; set output '%s'",
+        snprintf(buf, L_BUFSIZE, "set terminal latex; set output '%s'",
                  gplot->outname);
     }
     sarrayAddString(gplot->cmddata, buf, L_COPY);
 
     if (gplot->scaling == GPLOT_LOG_SCALE_X ||
         gplot->scaling == GPLOT_LOG_SCALE_X_Y) {
-        snprintf(buf, L_BUF_SIZE, "set logscale x");
+        snprintf(buf, L_BUFSIZE, "set logscale x");
         sarrayAddString(gplot->cmddata, buf, L_COPY);
     }
     if (gplot->scaling == GPLOT_LOG_SCALE_Y ||
         gplot->scaling == GPLOT_LOG_SCALE_X_Y) {
-        snprintf(buf, L_BUF_SIZE, "set logscale y");
+        snprintf(buf, L_BUFSIZE, "set logscale y");
         sarrayAddString(gplot->cmddata, buf, L_COPY);
     }
 
     nplots = sarrayGetCount(gplot->datanames);
     for (i = 0; i < nplots; i++) {
         plottitle = sarrayGetString(gplot->plottitles, i, L_NOCOPY);
         dataname = sarrayGetString(gplot->datanames, i, L_NOCOPY);
         numaGetIValue(gplot->plotstyles, i, &plotstyle);
         if (nplots == 1) {
-            snprintf(buf, L_BUF_SIZE, "plot '%s' title '%s' %s",
+            snprintf(buf, L_BUFSIZE, "plot '%s' title '%s' %s",
                      dataname, plottitle, gplotstylenames[plotstyle]);
         } else {
             if (i == 0)
-                snprintf(buf, L_BUF_SIZE, "plot '%s' title '%s' %s, \\",
+                snprintf(buf, L_BUFSIZE, "plot '%s' title '%s' %s, \\",
                      dataname, plottitle, gplotstylenames[plotstyle]);
             else if (i < nplots - 1)
-                snprintf(buf, L_BUF_SIZE, " '%s' title '%s' %s, \\",
+                snprintf(buf, L_BUFSIZE, " '%s' title '%s' %s, \\",
                      dataname, plottitle, gplotstylenames[plotstyle]);
             else
-                snprintf(buf, L_BUF_SIZE, " '%s' title '%s' %s",
+                snprintf(buf, L_BUFSIZE, " '%s' title '%s' %s",
                      dataname, plottitle, gplotstylenames[plotstyle]);
         }
         sarrayAddString(gplot->cmddata, buf, L_COPY);
     }
 
@@ -818,11 +818,11 @@ NUMA    *nay;
  * \return  gplot, or NULL on error
  */
 GPLOT *
 gplotRead(const char  *filename)
 {
-char     buf[L_BUF_SIZE];
+char     buf[L_BUFSIZE];
 char    *rootname, *title, *xlabel, *ylabel, *ignores;
 l_int32  outformat, ret, version, ignore;
 FILE    *fp;
 GPLOT   *gplot;
 
@@ -842,20 +842,20 @@ GPLOT   *gplot;
     if (version != GPLOT_VERSION_NUMBER) {
         fclose(fp);
         return (GPLOT *)ERROR_PTR("invalid gplot version", procName, NULL);
     }
 
-    ignore = fscanf(fp, "Rootname: %s\n", buf);
+    ignore = fscanf(fp, "Rootname: %511s\n", buf);  /* L_BUFSIZE - 1 */
     rootname = stringNew(buf);
     ignore = fscanf(fp, "Output format: %d\n", &outformat);
-    ignores = fgets(buf, L_BUF_SIZE, fp);   /* Title: ... */
+    ignores = fgets(buf, L_BUFSIZE, fp);   /* Title: ... */
     title = stringNew(buf + 7);
     title[strlen(title) - 1] = '\0';
-    ignores = fgets(buf, L_BUF_SIZE, fp);   /* X axis label: ... */
+    ignores = fgets(buf, L_BUFSIZE, fp);   /* X axis label: ... */
     xlabel = stringNew(buf + 14);
     xlabel[strlen(xlabel) - 1] = '\0';
-    ignores = fgets(buf, L_BUF_SIZE, fp);   /* Y axis label: ... */
+    ignores = fgets(buf, L_BUFSIZE, fp);   /* Y axis label: ... */
     ylabel = stringNew(buf + 14);
     ylabel[strlen(ylabel) - 1] = '\0';
 
     gplot = gplotCreate(rootname, outformat, title, xlabel, ylabel);
     LEPT_FREE(rootname);
@@ -870,11 +870,11 @@ GPLOT   *gplot;
     sarrayDestroy(&gplot->datanames);
     sarrayDestroy(&gplot->plotdata);
     sarrayDestroy(&gplot->plottitles);
     numaDestroy(&gplot->plotstyles);
 
-    ignore = fscanf(fp, "Commandfile name: %s\n", buf);
+    ignore = fscanf(fp, "Commandfile name: %511s\n", buf);  /* L_BUFSIZE - 1 */
     stringReplace(&gplot->cmdname, buf);
     ignore = fscanf(fp, "\nCommandfile data:");
     gplot->cmddata = sarrayReadStream(fp);
     ignore = fscanf(fp, "\nDatafile names:");
     gplot->datanames = sarrayReadStream(fp);
@@ -884,11 +884,11 @@ GPLOT   *gplot;
     gplot->plottitles = sarrayReadStream(fp);
     ignore = fscanf(fp, "\nPlot styles:");
     gplot->plotstyles = numaReadStream(fp);
 
     ignore = fscanf(fp, "Number of plots: %d\n", &gplot->nplots);
-    ignore = fscanf(fp, "Output file name: %s\n", buf);
+    ignore = fscanf(fp, "Output file name: %511s\n", buf);
     stringReplace(&gplot->outname, buf);
     ignore = fscanf(fp, "Axis scaling: %d\n", &gplot->scaling);
 
     fclose(fp);
     return gplot;
diff --git a/src/ptabasic.c b/src/ptabasic.c
index aa2711f..063eef3 100644
--- a/src/ptabasic.c
+++ b/src/ptabasic.c
@@ -687,11 +687,11 @@ PTA   *pta;
  * \return  pta, or NULL on error
  */
 PTA *
 ptaReadStream(FILE  *fp)
 {
-char       typestr[128];
+char       typestr[128];  /* hardcoded below in fscanf */
 l_int32    i, n, ix, iy, type, version;
 l_float32  x, y;
 PTA       *pta;
 
     PROCNAME("ptaReadStream");
@@ -701,11 +701,11 @@ PTA       *pta;
 
     if (fscanf(fp, "\n Pta Version %d\n", &version) != 1)
         return (PTA *)ERROR_PTR("not a pta file", procName, NULL);
     if (version != PTA_VERSION_NUMBER)
         return (PTA *)ERROR_PTR("invalid pta version", procName, NULL);
-    if (fscanf(fp, " Number of pts = %d; format = %s\n", &n, typestr) != 2)
+    if (fscanf(fp, " Number of pts = %d; format = %127s\n", &n, typestr) != 2)
         return (PTA *)ERROR_PTR("not a pta file", procName, NULL);
     if (!strcmp(typestr, "float"))
         type = 0;
     else  /* typestr is "integer" */
         type = 1;
diff --git a/src/sel1.c b/src/sel1.c
index 9e22b36..b05db23 100644
--- a/src/sel1.c
+++ b/src/sel1.c
@@ -139,11 +139,11 @@
  */
 
 #include <string.h>
 #include "allheaders.h"
 
-static const l_int32  L_BUF_SIZE = 256;
+static const l_int32  L_BUFSIZE = 256;  /* hardcoded below in sscanf */
 static const l_int32  INITIAL_PTR_ARRAYSIZE = 50;  /* n'import quoi */
 static const l_int32  MANY_SELS = 1000;
 
     /* Static functions */
 static l_int32 selaExtendArray(SELA *sela);
@@ -976,11 +976,11 @@ char *
 selaGetCombName(SELA    *sela,
                 l_int32  size,
                 l_int32  direction)
 {
 char    *selname;
-char     combname[L_BUF_SIZE];
+char     combname[L_BUFSIZE];
 l_int32  i, nsels, sx, sy, found;
 SEL     *sel;
 
     PROCNAME("selaGetCombName");
 
@@ -989,13 +989,13 @@ SEL     *sel;
     if (direction != L_HORIZ && direction != L_VERT)
         return (char *)ERROR_PTR("invalid direction", procName, NULL);
 
         /* Derive the comb name we're looking for */
     if (direction == L_HORIZ)
-        snprintf(combname, L_BUF_SIZE, "sel_comb_%dh", size);
+        snprintf(combname, L_BUFSIZE, "sel_comb_%dh", size);
     else  /* direction == L_VERT */
-        snprintf(combname, L_BUF_SIZE, "sel_comb_%dv", size);
+        snprintf(combname, L_BUFSIZE, "sel_comb_%dv", size);
 
     found = FALSE;
     nsels = selaGetCount(sela);
     for (i = 0; i < nsels; i++) {
         sel = selaGetSel(sela, i);
@@ -1039,11 +1039,11 @@ static void selaComputeCompositeParameters(const char *fileout);
  */
 static void
 selaComputeCompositeParameters(const char  *fileout)
 {
 char    *str, *nameh1, *nameh2, *namev1, *namev2;
-char     buf[L_BUF_SIZE];
+char     buf[L_BUFSIZE];
 l_int32  size, size1, size2, len;
 SARRAY  *sa;
 SELA    *selabasic, *selacomb;
 
     selabasic = selaAddBasic(NULL);
@@ -1058,11 +1058,11 @@ SELA    *selabasic, *selacomb;
             namev2 = selaGetCombName(selacomb, size1 * size2, L_VERT);
         } else {
             nameh2 = stringNew("");
             namev2 = stringNew("");
         }
-        snprintf(buf, L_BUF_SIZE,
+        snprintf(buf, L_BUFSIZE,
                  "      { %d, %d, %d, \"%s\", \"%s\", \"%s\", \"%s\" },",
                  size, size1, size2, nameh1, nameh2, namev1, namev2);
         sarrayAddString(sa, buf, L_COPY);
         LEPT_FREE(nameh1);
         LEPT_FREE(nameh2);
@@ -1407,11 +1407,11 @@ SEL   *sel;
  */
 SEL  *
 selReadStream(FILE  *fp)
 {
 char    *selname;
-char     linebuf[L_BUF_SIZE];
+char     linebuf[L_BUFSIZE];
 l_int32  sy, sx, cy, cx, i, j, version, ignore;
 SEL     *sel;
 
     PROCNAME("selReadStream");
 
@@ -1421,14 +1421,14 @@ SEL     *sel;
     if (fscanf(fp, "  Sel Version %d\n", &version) != 1)
         return (SEL *)ERROR_PTR("not a sel file", procName, NULL);
     if (version != SEL_VERSION_NUMBER)
         return (SEL *)ERROR_PTR("invalid sel version", procName, NULL);
 
-    if (fgets(linebuf, L_BUF_SIZE, fp) == NULL)
+    if (fgets(linebuf, L_BUFSIZE, fp) == NULL)
         return (SEL *)ERROR_PTR("error reading into linebuf", procName, NULL);
     selname = stringNew(linebuf);
-    sscanf(linebuf, "  ------  %s  ------", selname);
+    sscanf(linebuf, "  ------  %200s  ------", selname);
 
     if (fscanf(fp, "  sy = %d, sx = %d, cy = %d, cx = %d\n",
             &sy, &sx, &cy, &cx) != 4) {
         LEPT_FREE(selname);
         return (SEL *)ERROR_PTR("dimensions not read", procName, NULL);

Vulnerable code:   * [php](http://en.wikipedia.org/wiki/PHP)  (scripting language for dynamic web pages)
static const l_int32  L_BUF_SIZE = 512;
char         buf[L_BUF_SIZE];
                ret = sscanf(argv[i] + 1, "prestring=%s", buf);
                if ((len = strlen(buf)) > L_BUF_SIZE - 3) {
                ret = sscanf(argv[i] + 1, "protos=%s", buf);
    snprintf(buf, L_BUF_SIZE,
        snprintf(buf, L_BUF_SIZE, "cpp -ansi -DNO_PROTOS %s %s",
 *     Utility for programmatic plotting using gnuplot 7.3.2 or later
 *         ~ output to png (color), ps (mono), x11 (color), latex (mono)
static const l_int32  L_BUF_SIZE = 512;
char     buf[L_BUF_SIZE];
    snprintf(buf, L_BUF_SIZE, "%s.cmd", rootname);
        snprintf(buf, L_BUF_SIZE, "%s.png", newroot);
        snprintf(buf, L_BUF_SIZE, "%s.ps", newroot);
        snprintf(buf, L_BUF_SIZE, "%s.eps", newroot);
        snprintf(buf, L_BUF_SIZE, "%s.tex", newroot);
char       buf[L_BUF_SIZE];
    snprintf(buf, L_BUF_SIZE, "%s.data.%d", gplot->rootname, gplot->nplots);
        snprintf(buf, L_BUF_SIZE, "%f %f\n", valx, valy);
char     buf[L_BUF_SIZE];
    snprintf(buf, L_BUF_SIZE, "gnuplot %s", cmdname);
    snprintf(buf, L_BUF_SIZE, "wgnuplot %s", cmdname);
char     buf[L_BUF_SIZE];
        snprintf(buf, L_BUF_SIZE, "set title '%s'", gplot->title);
        snprintf(buf, L_BUF_SIZE, "set xlabel '%s'", gplot->xlabel);
        snprintf(buf, L_BUF_SIZE, "set ylabel '%s'", gplot->ylabel);
        snprintf(buf, L_BUF_SIZE, "set terminal png; set output '%s'",
        snprintf(buf, L_BUF_SIZE, "set terminal postscript; set output '%s'",
        snprintf(buf, L_BUF_SIZE,
        snprintf(buf, L_BUF_SIZE, "set terminal latex; set output '%s'",
        snprintf(buf, L_BUF_SIZE, "set logscale x");
        snprintf(buf, L_BUF_SIZE, "set logscale y");
            snprintf(buf, L_BUF_SIZE, "plot '%s' title '%s' %s",
                snprintf(buf, L_BUF_SIZE, "plot '%s' title '%s' %s, \\",
                snprintf(buf, L_BUF_SIZE, " '%s' title '%s' %s, \\",
                snprintf(buf, L_BUF_SIZE, " '%s' title '%s' %s",
char     buf[L_BUF_SIZE];
    ignore = fscanf(fp, "Rootname: %s\n", buf);
    ignores = fgets(buf, L_BUF_SIZE, fp);   /* Title: ... */
    ignores = fgets(buf, L_BUF_SIZE, fp);   /* X axis label: ... */
    ignores = fgets(buf, L_BUF_SIZE, fp);   /* Y axis label: ... */
    ignore = fscanf(fp, "Commandfile name: %s\n", buf);
    ignore = fscanf(fp, "Output file name: %s\n", buf);
char       typestr[128];
    if (fscanf(fp, " Number of pts = %d; format = %s\n", &n, typestr) != 2)
static const l_int32  L_BUF_SIZE = 256;
char     combname[L_BUF_SIZE];
        snprintf(combname, L_BUF_SIZE, "sel_comb_%dh", size);
        snprintf(combname, L_BUF_SIZE, "sel_comb_%dv", size);
char     buf[L_BUF_SIZE];
        snprintf(buf, L_BUF_SIZE,
char     linebuf[L_BUF_SIZE];
    if (fgets(linebuf, L_BUF_SIZE, fp) == NULL)
    sscanf(linebuf, "  ------  %s  ------", selname);
Fixed code:   * [OpenCV](https://github.com/opencv/opencv) (computer vision library)
  * [php](http://en.wikipedia.org/wiki/PHP)  (scripting language for dynamic web pages)
static const l_int32  L_BUFSIZE = 512;  /* hardcoded below in sscanf() */
char         buf[L_BUFSIZE];
                ret = sscanf(argv[i] + 1, "prestring=%490s", buf);
                if ((len = strlen(buf)) > L_BUFSIZE - 3) {
                ret = sscanf(argv[i] + 1, "protos=%490s", buf);
    snprintf(buf, L_BUFSIZE,
        snprintf(buf, L_BUFSIZE, "cpp -ansi -DNO_PROTOS %s %s",
 *     Utility for programmatic plotting using gnuplot 4.6 or later
 *         ~ output to png (color), ps and eps (mono), latex (mono)
static const l_int32  L_BUFSIZE = 512;  /* hardcoded below in fscanf */
char     buf[L_BUFSIZE];
    snprintf(buf, L_BUFSIZE, "%s.cmd", rootname);
        snprintf(buf, L_BUFSIZE, "%s.png", newroot);
        snprintf(buf, L_BUFSIZE, "%s.ps", newroot);
        snprintf(buf, L_BUFSIZE, "%s.eps", newroot);
        snprintf(buf, L_BUFSIZE, "%s.tex", newroot);
char       buf[L_BUFSIZE];
    snprintf(buf, L_BUFSIZE, "%s.data.%d", gplot->rootname, gplot->nplots);
        snprintf(buf, L_BUFSIZE, "%f %f\n", valx, valy);
char     buf[L_BUFSIZE];
    snprintf(buf, L_BUFSIZE, "gnuplot %s", cmdname);
    snprintf(buf, L_BUFSIZE, "wgnuplot %s", cmdname);
char     buf[L_BUFSIZE];
        snprintf(buf, L_BUFSIZE, "set title '%s'", gplot->title);
        snprintf(buf, L_BUFSIZE, "set xlabel '%s'", gplot->xlabel);
        snprintf(buf, L_BUFSIZE, "set ylabel '%s'", gplot->ylabel);
        snprintf(buf, L_BUFSIZE, "set terminal png; set output '%s'",
        snprintf(buf, L_BUFSIZE, "set terminal postscript; set output '%s'",
        snprintf(buf, L_BUFSIZE,
        snprintf(buf, L_BUFSIZE, "set terminal latex; set output '%s'",
        snprintf(buf, L_BUFSIZE, "set logscale x");
        snprintf(buf, L_BUFSIZE, "set logscale y");
            snprintf(buf, L_BUFSIZE, "plot '%s' title '%s' %s",
                snprintf(buf, L_BUFSIZE, "plot '%s' title '%s' %s, \\",
                snprintf(buf, L_BUFSIZE, " '%s' title '%s' %s, \\",
                snprintf(buf, L_BUFSIZE, " '%s' title '%s' %s",
char     buf[L_BUFSIZE];
    ignore = fscanf(fp, "Rootname: %511s\n", buf);  /* L_BUFSIZE - 1 */
    ignores = fgets(buf, L_BUFSIZE, fp);   /* Title: ... */
    ignores = fgets(buf, L_BUFSIZE, fp);   /* X axis label: ... */
    ignores = fgets(buf, L_BUFSIZE, fp);   /* Y axis label: ... */
    ignore = fscanf(fp, "Commandfile name: %511s\n", buf);  /* L_BUFSIZE - 1 */
    ignore = fscanf(fp, "Output file name: %511s\n", buf);
char       typestr[128];  /* hardcoded below in fscanf */
    if (fscanf(fp, " Number of pts = %d; format = %127s\n", &n, typestr) != 2)
static const l_int32  L_BUFSIZE = 256;  /* hardcoded below in sscanf */
char     combname[L_BUFSIZE];
        snprintf(combname, L_BUFSIZE, "sel_comb_%dh", size);
        snprintf(combname, L_BUFSIZE, "sel_comb_%dv", size);
char     buf[L_BUFSIZE];
        snprintf(buf, L_BUFSIZE,
char     linebuf[L_BUFSIZE];
    if (fgets(linebuf, L_BUFSIZE, fp) == NULL)
    sscanf(linebuf, "  ------  %200s  ------", selname);