abimaelmartell/system_monitor — pull request #2 by dualbus (2014-05-06 11:20:23+00:00)
Title: Fix buffer overflows due to non-safe usage of sprintf

The combination of fixed size buffers and non-safe functions like
sprintf, which do not check the size of the buffer when writing, is
bad.

A malicious attacker could use this error to crash the web server, or
even execute code remotely (though I'm not sure how easy that is).

The exploits to make the web server segfault are simple:

bash$ curl localhost:3000/"$(printf %.0sx {1..1024})" # request_handler
bash$ curl localhost:3000/"$(printf %.0sx {1..2048})" # log_line

The size of the URL determines on which function crashes first.

I changed the unsafe code with snprintf's, which do check the size of
the buffer before writing. If the buffer is smaller than the source
string, only the data that fits will be written. The rest is
discarded.

I also put a not-really-smart MAX_BUFFER_SIZE limit that's so big,
that Mongoose will reject the request at smaller sizes, so we do not
have to worry about this.