CVE-2020-22873 (published 2021-07-13T15:15Z)

Buffer overflow vulnerability in function NumberToPrecisionCmd in jsish before 3.0.7, allows remote attackers to execute arbitrary code.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-120
cwe_name: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
description: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
extended_description: A buffer overflow condition exists when a product attempts to put more data in a buffer than it can hold, or when it attempts to put data in a memory area outside of the boundaries of a buffer. The simplest type of error, and the most common cause of buffer overflows, is the "classic" case in which the product copies the buffer without restricting how much is copied. Other variants exist, but the existence of a classic overflow strongly suggests that the programmer is not considering even the most basic of security protections.
         

Fix information:
repo_url: https://github.com/pcmacdon/jsish
commit_details: repo_url: https://github.com/pcmacdon/jsish
author: pmacdona
author_date: 2020-04-13 19:04:14+00:00
msg: Release "3.0.7": Fix toPrecision bug "stack overflow #4".

FossilOrigin-Name: 6c7f0c37027d7f890b57cb38f776af39b8f81f03e60ceeb0a231a1d21e24b5de
repository: repo_url: https://github.com/pcmacdon/jsish
repo_name: pcmacdon/jsish
description: Jsi is a small, C-embeddable javascript interpreter with tightly woven Web and DB support.
repo_language: C
owner: pcmacdon
file_changes: filename: jsi.h
change_type: ModificationType.MODIFY
diff: @@ -4,7 +4,7 @@
 
 #define JSI_VERSION_MAJOR   3
 #define JSI_VERSION_MINOR   0
-#define JSI_VERSION_RELEASE 6
+#define JSI_VERSION_RELEASE 7
 
 #define JSI_VERSION (JSI_VERSION_MAJOR + ((Jsi_Number)JSI_VERSION_MINOR/100.0) + ((Jsi_Number)JSI_VERSION_RELEASE/10000.0))
 
@@ -213,7 +213,7 @@ typedef enum {
     JSI_DBI_NO_MUTEX     =0x0004, /* Disable mutex. */
     JSI_DBI_FULL_MUTEX   =0x0008, /* Use full mutex. */
     
-    JSI_MAX_NUMBER_STRING=50,
+    JSI_MAX_NUMBER_STRING=100,
     JSI_BUFSIZ=8192
 
 } Jsi_Enums; /* Debugging is easier with enums than #define. */

programming_language: C
filename: jsiCmds.c
change_type: ModificationType.MODIFY
diff: @@ -845,7 +845,7 @@ Jsi_RC jsi_PkgDumpInfo(Jsi_Interp *interp, const char *name, Jsi_Value **ret) {
         Jsi_ObjInsert(interp, nobj, "name", Jsi_ValueNewStringDup(interp, name), 0);
         Jsi_ObjInsert(interp, nobj, "version", Jsi_ValueNewNumber(interp, ptr->version), 0);
         Jsi_ObjInsert(interp, nobj, "lastReq", Jsi_ValueNewNumber(interp, ptr->lastReq), 0);
-        char buf[200];
+        char buf[JSI_MAX_NUMBER_STRING*2];
         jsi_VersionNormalize(ptr->version, buf, sizeof(buf));
         Jsi_ObjInsert(interp, nobj, "verStr", Jsi_ValueNewStringDup(interp, buf), 0);
         const char *cp = (ptr->loadFile?ptr->loadFile:"");
@@ -1192,7 +1192,7 @@ static Jsi_RC SysGetEnvCmd(Jsi_Interp *interp, Jsi_Value *args, Jsi_Value *_this
     Jsi_Value *vres;
     Jsi_Obj  *ores = Jsi_ObjNew(interp);
     Jsi_Value *nnv;
-    char *val, nam[200];
+    char *val, nam[JSI_BUFSIZ/2];
     //Jsi_ObjIncrRefCount(interp, ores);
     vres = Jsi_ValueMakeObject(interp, NULL, ores);
     //Jsi_IncrRefCount(interp, vres);
@@ -2700,7 +2700,7 @@ static Jsi_RC DebugAddCmd(Jsi_Interp *interp, Jsi_Value *args, Jsi_Value *_this,
     }
     if (bp.line<=0 && !bp.func) 
         return Jsi_LogError("bad number");
-    char nbuf[100];
+    char nbuf[JSI_MAX_NUMBER_STRING];
     bp.id = ++interp->debugOpts.breakIdx;
     bp.enabled = 1;
     snprintf(nbuf, sizeof(nbuf), "%d", bp.id);
@@ -2718,7 +2718,7 @@ static Jsi_RC DebugRemoveCmd_(Jsi_Interp *interp, Jsi_Value *args, Jsi_Value *_t
     if (interp->breakpointHash)
     {
         int num;
-        char nbuf[100];
+        char nbuf[JSI_MAX_NUMBER_STRING];
         if (Jsi_GetIntFromValue(interp, val, &num) != JSI_OK) 
             return Jsi_LogError("bad number");
         
@@ -2766,7 +2766,7 @@ static Jsi_RC DebugInfoCmd(Jsi_Interp *interp, Jsi_Value *args, Jsi_Value *_this
         return Jsi_HashKeysDump(interp, interp->breakpointHash, ret, 0);
     Jsi_Value *val = Jsi_ValueArrayIndex(interp, args, 0);
     int num;
-    char nbuf[100];
+    char nbuf[JSI_MAX_NUMBER_STRING];
     if (Jsi_GetIntFromValue(interp, val, &num) != JSI_OK) 
         return Jsi_LogError("bad number");
     
@@ -3800,7 +3800,7 @@ static Jsi_RC SysVerConvertCmd(Jsi_Interp *interp, Jsi_Value *args, Jsi_Value *_
     Jsi_Value *flag = Jsi_ValueArrayIndex(interp, args, 1);
     if (!val) goto bail;
     if (Jsi_ValueIsNumber(interp, val)) {
-        char buf[200];
+        char buf[JSI_MAX_NUMBER_STRING*2];
         Jsi_Number n;
         if (Jsi_GetNumberFromValue(interp, val, &n) != JSI_OK)
             goto bail;
@@ -3953,7 +3953,7 @@ static Jsi_RC SysTimesCmd(Jsi_Interp *interp, Jsi_Value *args, Jsi_Value *_this,
         if (bv)
             interp->timesStart = now;
         else {
-            char buf[100];
+            char buf[JSI_MAX_NUMBER_STRING];
             snprintf(buf, sizeof(buf), " (times = %.6f sec)\n", (now-interp->timesStart));
             Jsi_Puts(interp, jsi_Stderr, buf, -1);
         }

programming_language: C
filename: jsiCode.c
change_type: ModificationType.MODIFY
diff: @@ -436,7 +436,7 @@ void jsi_code_decode(Jsi_Interp *interp, jsi_OpCode *op, int currentip, char *bu
     if (_JSICASTINT(op->op) < 0 || op->op >= OP_LASTOP) {
         snprintf(buf, bsiz, "Bad opcode[%d] at %d", op->op, currentip);
     }
-    char nbuf[100];
+    char nbuf[JSI_MAX_NUMBER_STRING];
     snprintf(nbuf, sizeof(nbuf), "%d#%d", currentip, op->Line);
     snprintf(buf, bsiz, "%-8s %s ", nbuf, jsi_op_names[op->op]);
 

programming_language: C
filename: jsiEval.c
change_type: ModificationType.MODIFY
diff: @@ -287,23 +287,23 @@ static Jsi_RC jsi_logic_less(Jsi_Interp* interp, int i1, int i2) {
 
 static const char *jsi_evalprint(Jsi_Value *v)
 {
-    static char buf[100];
+    static char buf[JSI_MAX_NUMBER_STRING];
     if (!v)
         return "nil";
     if (v->vt == JSI_VT_NUMBER) {
-        snprintf(buf, 100, "NUM:%" JSI_NUMGFMT " ", v->d.num);
+        snprintf(buf, sizeof(buf), "NUM:%" JSI_NUMGFMT " ", v->d.num);
     } else if (v->vt == JSI_VT_BOOL) {
-        snprintf(buf, 100, "BOO:%d", v->d.val);
+        snprintf(buf, sizeof(buf), "BOO:%d", v->d.val);
     } else if (v->vt == JSI_VT_STRING) {
-        snprintf(buf, 100, "STR:'%s'", v->d.s.str);
+        snprintf(buf, sizeof(buf), "STR:'%s'", v->d.s.str);
     } else if (v->vt == JSI_VT_VARIABLE) {
-        snprintf(buf, 100, "VAR:%p", v->d.lval);
+        snprintf(buf, sizeof(buf), "VAR:%p", v->d.lval);
     } else if (v->vt == JSI_VT_NULL) {
-        snprintf(buf, 100, "NULL");
+        snprintf(buf, sizeof(buf), "NULL");
     } else if (v->vt == JSI_VT_OBJECT) {
-        snprintf(buf, 100, "OBJ:%p", v->d.obj);
+        snprintf(buf, sizeof(buf), "OBJ:%p", v->d.obj);
     } else if (v->vt == JSI_VT_UNDEF) {
-        snprintf(buf, 100, "UNDEFINED");
+        snprintf(buf, sizeof(buf), "UNDEFINED");
     }
     return buf;
 }
@@ -403,7 +403,7 @@ static void jsiDumpInstr(Jsi_Interp *interp, jsi_Pstate *ps, Jsi_Value *_this,
     jsi_TryList *trylist, jsi_OpCode *ip, Jsi_OpCodes *opcodes)
 {
     int i;
-    char buf[200];
+    char buf[JSI_MAX_NUMBER_STRING*2];
     jsi_code_decode(interp, ip, ip - opcodes->codes, buf, sizeof(buf));
     Jsi_Printf(interp, jsi_Stderr, "%p: %-30.200s : THIS=%s, STACK=[", ip, buf, jsi_evalprint(_this));
     for (i = 0; i < interp->framePtr->Sp; ++i) {
@@ -1538,7 +1538,7 @@ Jsi_RC jsi_evalcode_sub(jsi_Pstate *ps, Jsi_OpCodes *opcodes,
                     break;
                 }
                 int bval = 0;
-                char nbuf[100];
+                char nbuf[JSI_MAX_NUMBER_STRING];
                 Jsi_Value *vv;
                 Jsi_Obj *obj = v->d.obj;
                 if (!cp) {
@@ -2155,7 +2155,7 @@ Jsi_RC jsi_evalcode(jsi_Pstate *ps, Jsi_Func *func, Jsi_OpCodes *opcodes,
     Jsi_IncrRefCount(interp, fargs);
     rc = jsi_evalcode_sub(ps, opcodes, scope, fargs, _this, *vret);
     Jsi_DecrRefCount(interp, fargs);
-    if (interp->didReturn == 0 && !interp->exited) {
+    if (interp->didReturn == 0 && !interp->exited && rc == JSI_OK) {
         if ((interp->evalFlags&JSI_EVAL_RETURN)==0)
             Jsi_ValueMakeUndef(interp, vret);
         /*if (interp->framePtr->Sp != oldSp) //TODO: at some point after memory refs???

programming_language: C++
filename: jsiFilesys.c
change_type: ModificationType.MODIFY
diff: @@ -1177,7 +1177,7 @@ const char *jsi_GetHomeDir(Jsi_Interp *interp) {
         
     if ((str = getenv("HOME")) == NULL) {
         struct passwd pwd, *pw;
-        char buf[20000];
+        char buf[JSI_BUFSIZ*3];
         if (getpwuid_r(getuid(), &pwd, buf, sizeof(buf), &pw) == 0 && pw->pw_dir)        
             str = pw->pw_dir;
     }

programming_language: C
filename: jsiFunc.c
change_type: ModificationType.MODIFY
diff: @@ -189,7 +189,7 @@ const char *jsiFuncInfo(Jsi_Interp *interp, Jsi_DString *dStr, Jsi_Func* func, J
 Jsi_RC jsi_ArgTypeCheck(Jsi_Interp *interp, int typ,  Jsi_Value *arg, const char *p1,
     const char *p2, int index, Jsi_Func *func, bool isdefault) {
     Jsi_RC rc = JSI_OK;
-    char idxBuf[200];
+    char idxBuf[JSI_MAX_NUMBER_STRING*2];
     idxBuf[0] = 0;
     if (func && arg->vt == JSI_VT_UNDEF && !interp->typeCheck.noundef && index>0 && !isdefault && !(typ&JSI_TT_UNDEFINED)) {
         snprintf(idxBuf, sizeof(idxBuf), " arg %d", index);
@@ -295,7 +295,7 @@ done:
         Jsi_DString dStr = {};
         const char *exp = jsi_typeName(interp, typ, &dStr);
         const char *vtyp = jsi_TypeName(interp, (Jsi_ttype)atyp);
-        char idxBuf[200];
+        char idxBuf[JSI_MAX_NUMBER_STRING*2];
         idxBuf[0] = 0;
         if (index>0)
             snprintf(idxBuf, sizeof(idxBuf), " arg %d", index);
@@ -339,7 +339,7 @@ Jsi_RC jsi_RunFuncCallCheck(Jsi_Interp *interp, Jsi_Func *func, int argc, const
     if (ss==NULL && spec == NULL)
         return JSI_OK;
     int i, minArgs, maxArgs, mis = 0, varargs = 0;
-    char nbuf[100];
+    char nbuf[JSI_MAX_NUMBER_STRING];
     if (func->type == FC_BUILDIN) {
         varargs =  (spec->maxArgs<0);
         maxArgs = spec->maxArgs + func->callflags.bits.addargs;

programming_language: C++
filename: jsiHash.c
change_type: ModificationType.MODIFY
diff: @@ -623,7 +623,7 @@ static Jsi_Value *jsi_hashFmtKey(Jsi_MapEntry* h, struct Jsi_MapOpts *opts, int
     void *key = Jsi_HashKeyGet(hPtr);
     if (opts->keyType == JSI_KEYS_ONEWORD)
         return Jsi_ValueNewNumber(opts->interp, (Jsi_Number)(intptr_t)key);
-    char nbuf[100];
+    char nbuf[JSI_MAX_NUMBER_STRING];
     snprintf(nbuf, sizeof(nbuf), "%p", key);
     return Jsi_ValueNewStringDup(opts->interp, nbuf);
 }

programming_language: C
filename: jsiInterp.c
change_type: ModificationType.MODIFY
diff: @@ -700,7 +700,7 @@ static Jsi_RC jsi_InterpDelete(Jsi_Interp *interp, void *ptr) {
 
 Jsi_Interp* Jsi_Main(Jsi_InterpOpts *opts)
 {
-    int rc = 0;
+    Jsi_RC rc = JSI_OK;
     Jsi_Interp* interp = NULL;
     int argc = 0, first = 1;
     char **argv = NULL;
@@ -929,7 +929,7 @@ dofile:
     }
     if (jsi_deleted) //TODO: rationalize jsi_deleted, jsi_exitCode, etc
         return jsi_DoExit(rc==JSI_EXIT?NULL:interp, jsi_exitCode);
-    if (rc == 0) {
+    if (rc == JSI_OK) {
         /* Skip output from an ending semicolon which evaluates to undefined */
         Jsi_Value *ret = Jsi_ReturnValue(interp);
         if (!Jsi_ValueIsType(interp, ret, JSI_VT_UNDEF)) {
@@ -940,7 +940,7 @@ dofile:
         }
     } else {
         if (!interp->parent && !interp->isHelp)
-            fputs("ERROR\n", stderr);
+            fprintf(stderr, "ERROR: %s\n", interp->errMsgBuf);
         return jsi_DoExit(interp, 1);
     }
 

programming_language: C
filename: jsiJSON.c
change_type: ModificationType.MODIFY
diff: @@ -6,7 +6,7 @@
 
 static void jsonNewDString(Jsi_Interp *interp, Jsi_DString *dStr, const char* str, int len)
 {
-    char buf[100], *dp = buf;
+    char buf[JSI_MAX_NUMBER_STRING], *dp = buf;
     const char *cp = str;
     int ulen;
     

programming_language: C
filename: jsiMySql.c
change_type: ModificationType.MODIFY
diff: @@ -1169,7 +1169,7 @@ static void mdbDeleteCmd(MySqlObj *jdb)
 */
 static void mdbEvalSetColumnJSON(MyDbEvalContext *p, int iCol, Jsi_DString *dStr) {
     Jsi_Interp *interp = p->jdb->interp;
-    char nbuf[200];
+    char nbuf[JSI_MAX_NUMBER_STRING];
     MysqlPrep *prep = p->prep;
     SqlFieldResults *field = prep->fieldResult+iCol;
     if (field->isnull) {
@@ -1219,7 +1219,7 @@ static void mdbEvalSetColumnJSON(MyDbEvalContext *p, int iCol, Jsi_DString *dStr
 
 static void mdbEvalSetColumn(MyDbEvalContext *p, int iCol, Jsi_DString *dStr) {
     //Jsi_Interp *interp = p->jdb->interp;
-    char nbuf[200];
+    char nbuf[JSI_MAX_NUMBER_STRING];
     MysqlPrep *prep = p->prep;
     SqlFieldResults *field = prep->fieldResult+iCol;
     Jsi_Interp *interp = p->jdb->interp;

programming_language: C
filename: jsiNumber.c
change_type: ModificationType.MODIFY
diff: @@ -123,7 +123,7 @@ static Jsi_RC NumberConstructor(Jsi_Interp *interp, Jsi_Value *args, Jsi_Value *
 static Jsi_RC NumberToFixedCmd(Jsi_Interp *interp, Jsi_Value *args, Jsi_Value *_this,
     Jsi_Value **ret, Jsi_Func *funcPtr)
 {
-    char buf[100];
+    char buf[JSI_MAX_NUMBER_STRING+1];
     int prec = 0, skip = 0;
     Jsi_Number num;
     Jsi_Value *v;
@@ -141,14 +141,14 @@ static Jsi_RC NumberToFixedCmd(Jsi_Interp *interp, Jsi_Value *args, Jsi_Value *_
 static Jsi_RC NumberToPrecisionCmd(Jsi_Interp *interp, Jsi_Value *args, Jsi_Value *_this,
     Jsi_Value **ret, Jsi_Func *funcPtr)
 {
-    char buf[100];
+    char buf[JSI_MAX_NUMBER_STRING*2];
     int prec = 0, skip = 0;
     Jsi_Number num;
     Jsi_Value *v;
     ChkStringN(_this, funcPtr, v);
     if (Jsi_GetIntFromValue(interp, Jsi_ValueArrayIndex(interp, args, skip), &prec) != JSI_OK)
         return JSI_ERROR;
-    if (prec<=0) return JSI_ERROR;
+    if (prec<=0 || prec>JSI_MAX_NUMBER_STRING) return Jsi_LogError("precision must be between 1 and %d", JSI_MAX_NUMBER_STRING);
     Jsi_GetDoubleFromValue(interp, v, &num);
     snprintf(buf, sizeof(buf),"%.*" JSI_NUMFFMT, prec, num);
     if (num<0)
@@ -163,7 +163,7 @@ static Jsi_RC NumberToPrecisionCmd(Jsi_Interp *interp, Jsi_Value *args, Jsi_Valu
 static Jsi_RC NumberToExponentialCmd(Jsi_Interp *interp, Jsi_Value *args, Jsi_Value *_this,
     Jsi_Value **ret, Jsi_Func *funcPtr)
 {
-    char buf[100];
+    char buf[JSI_MAX_NUMBER_STRING+1];
     int prec = 0, skip = 0;
     Jsi_Number num;
     Jsi_Value *v;
@@ -191,7 +191,7 @@ static Jsi_RC NumberToExponentialCmd(Jsi_Interp *interp, Jsi_Value *args, Jsi_Va
 static Jsi_RC NumberToStringCmd(Jsi_Interp *interp, Jsi_Value *args, Jsi_Value *_this,
     Jsi_Value **ret, Jsi_Func *funcPtr)
 {
-    char buf[500];
+    char buf[JSI_MAX_NUMBER_STRING+1];
     int radix = 10, skip = 0, argc = Jsi_ValueGetLength(interp, args);
     Jsi_Number num;
     Jsi_Value *v;

programming_language: C
filename: jsiOptions.c
change_type: ModificationType.MODIFY
diff: @@ -1876,7 +1876,7 @@ static Jsi_RC jsi_BitfieldToValue(Jsi_Interp *interp, Jsi_OptionSpec* spec, Jsi_
         if (JSI_OK != jsi_EnumToValue(interp, eSpec, outValue, outStr, (void*)&nval, flags))
             return JSI_ERROR;
     } else if (outStr) {
-        char obuf[100];
+        char obuf[JSI_MAX_NUMBER_STRING];
         snprintf(obuf, sizeof(obuf), "%" PRId64, inum);
         Jsi_DSAppend(outStr, obuf, NULL);
     } else {

programming_language: C++
filename: jsiPstate.c
change_type: ModificationType.MODIFY
diff: @@ -239,8 +239,8 @@ int jsi_PstateSetFile(jsi_Pstate *ps, Jsi_Channel fp, int skipbang)
     l->d.fp = fp;
     Jsi_Rewind(ps->interp, fp);
     if (skipbang) {
-        char buf[1000];
-        if (Jsi_Gets(ps->interp, fp, buf, 1000) && (buf[0] != '#' || buf[1] != '!')) {
+        char buf[JSI_BUFSIZ];
+        if (Jsi_Gets(ps->interp, fp, buf, sizeof(buf)) && (buf[0] != '#' || buf[1] != '!')) {
             Jsi_Rewind(ps->interp, fp);
         }
     }

programming_language: C++
filename: jsiRegexp.c
change_type: ModificationType.MODIFY
diff: @@ -162,7 +162,7 @@ Jsi_RC Jsi_RegExpMatch(Jsi_Interp *interp, Jsi_Value *pattern, const char *v, in
     int r  = regexec(reg, v, 1, &pos, regexec_flags);
 
     if (r >= REG_BADPAT) {
-        char buf[100];
+        char buf[JSI_MAX_NUMBER_STRING];
 
         regerror(r, reg, buf, sizeof(buf));
         return Jsi_LogError("error while matching pattern: %s", buf);

programming_language: C
filename: jsiSqlite.c
change_type: ModificationType.MODIFY
diff: @@ -1395,7 +1395,7 @@ static void jsiSqlFunc(sqlite3_context *context, int argc, sqlite3_value**argv)
 
     bool b;
     if( rc != JSI_OK) {
-        char buf[250];
+        char buf[JSI_BUFSIZ];
         snprintf(buf, sizeof(buf), "error in function: %.200s", p->zName);
         sqlite3_result_error(context, buf, -1);
 
@@ -1760,7 +1760,7 @@ static void dbEvalRowInfo(
 */
 static void dbEvalSetColumnJSON(DbEvalContext *p, int iCol, Jsi_DString *dStr) {
     Jsi_Interp *interp = p->jdb->interp;
-    char nbuf[200];
+    char nbuf[JSI_MAX_NUMBER_STRING];
 
     sqlite3_stmt *pStmt = p->pPreStmt->pStmt;
 
@@ -1810,7 +1810,7 @@ static void dbEvalSetColumnJSON(DbEvalContext *p, int iCol, Jsi_DString *dStr) {
 
 static void dbEvalSetColumn(DbEvalContext *p, int iCol, Jsi_DString *dStr) {
     Jsi_Interp *interp = p->jdb->interp;
-    char nbuf[200];
+    char nbuf[JSI_MAX_NUMBER_STRING];
 
     sqlite3_stmt *pStmt = p->pPreStmt->pStmt;
 
@@ -2560,7 +2560,7 @@ static void dbOutputQuotedString(Jsi_DString *dStr, const char *z) {
 */
 static void dbOutputHexBlob(Jsi_DString *dStr, const void *pBlob, int nBlob){
   int i;
-  char out[100], *zBlob = (char *)pBlob;
+  char out[JSI_MAX_NUMBER_STRING], *zBlob = (char *)pBlob;
   Jsi_DSAppend(dStr, "X'", NULL);
   for(i=0; i<nBlob; i++){ snprintf(out, sizeof(out),"%02x",zBlob[i]&0xff);Jsi_DSAppend(dStr, out, NULL); }
   Jsi_DSAppend(dStr, "'", NULL);
@@ -4393,7 +4393,7 @@ static int jsi_DbQuery(Jsi_Db *jdb, Jsi_CDataDb *dbopts, const char *query)
         
     DbEvalContext sEval = {};
     int insert = 0, replace = 0, update = 0;
-    char nbuf[100], *bPtr;
+    char nbuf[JSI_MAX_NUMBER_STRING], *bPtr;
 #ifdef JSI_DB_DSTRING_SIZE
     JSI_DSTRING_VAR(dStr, JSI_DB_DSTRING_SIZE);
 #else

programming_language: C
filename: jsiString.c
change_type: ModificationType.MODIFY
diff: @@ -724,7 +724,7 @@ static Jsi_RC StringReplaceCmd(Jsi_Interp *interp, Jsi_Value *args, Jsi_Value *_
         int match = regexec(regex, p, MAX_SUBREGEX, pmatch, regexec_flags);
 
         if (match >= REG_BADPAT) {
-            char buf[100];
+            char buf[JSI_MAX_NUMBER_STRING];
 
             regerror(match, regex, buf, sizeof(buf));
             Jsi_LogError("error while matching pattern: %s", buf);
@@ -895,7 +895,7 @@ static Jsi_RC StringSearchCmd(Jsi_Interp *interp, Jsi_Value *args, Jsi_Value *_t
             return JSI_OK;
         }
         if (r >= REG_BADPAT) {
-            char buf[100];
+            char buf[JSI_MAX_NUMBER_STRING];
 
             regerror(r, reg, buf, sizeof(buf));
             Jsi_LogError("error while matching pattern: %s", buf);

programming_language: C++
filename: jsiTree.c
change_type: ModificationType.MODIFY
diff: @@ -946,7 +946,7 @@ static void TreeTest(Jsi_Interp* interp) {
         int n;
         int m;
     } t1, t2;
-    char nbuf[100];
+    char nbuf[JSI_MAX_NUMBER_STRING];
     
     wt = Jsi_TreeNew(interp, JSI_KEYS_ONEWORD, NULL);
     mt = Jsi_TreeNew(interp, sizeof(struct tdata), NULL);
@@ -1038,7 +1038,7 @@ static Jsi_Value *jsi_treeFmtKey(Jsi_MapEntry* h, struct Jsi_MapOpts *opts, int
     void *key = Jsi_TreeKeyGet(hPtr);
     if (opts->keyType == JSI_KEYS_ONEWORD)
         return Jsi_ValueNewNumber(opts->interp, (Jsi_Number)(intptr_t)key);
-    char nbuf[100];
+    char nbuf[JSI_MAX_NUMBER_STRING];
     snprintf(nbuf, sizeof(nbuf), "%p", key);
     return Jsi_ValueNewStringDup(opts->interp, nbuf);
 }

programming_language: C
filename: jsiUtils.c
change_type: ModificationType.MODIFY
diff: @@ -625,7 +625,7 @@ static Jsi_RC _object_get_callback(Jsi_Tree *tree, Jsi_TreeEntry *hPtr, void *da
 /* Format value into dStr.  Toplevel caller does init/free. */
 static Jsi_RC jsiValueGetString(Jsi_Interp *interp, Jsi_Value* v, Jsi_DString *dStr, objwalker *owPtr)
 {
-    char buf[100], *str;
+    char buf[JSI_MAX_NUMBER_STRING], *str;
     Jsi_DString eStr;
     Jsi_DSInit(&eStr);
     if (interp->maxDepth>0 && owPtr->depth > interp->maxDepth)
@@ -943,7 +943,7 @@ char *jsiLNhints(const char *buf, int *color, int *bold) {
 }
 
 static void jsiLNGetMatches(const char *str, linenoiseCompletions *lc) {
-    char buf[1000], pre[1000], hpre[6] = {};
+    char buf[JSI_BUFSIZ], pre[JSI_BUFSIZ], hpre[6] = {};
     const char *cp, *fnam = "Info.completions";
     int i = 0, len;
     int rc, isfile = 0, start = 0, end = Jsi_Strlen(str);

programming_language: C++
filename: jsiValue.c
change_type: ModificationType.MODIFY
diff: @@ -401,7 +401,7 @@ Jsi_Value *Jsi_ValueArrayIndex(Jsi_Interp *interp, Jsi_Value *args, int index)
     assert(args->vt == JSI_VT_OBJECT);
     if (obj->isarrlist && obj->arr)
         return ((index < 0 || (uint)index >= obj->arrCnt) ? NULL : obj->arr[index]);
-    char unibuf[100];
+    char unibuf[JSI_MAX_NUMBER_STRING];
     Jsi_NumberItoA10(index, unibuf, sizeof(unibuf));
     v = Jsi_TreeObjGetValue(args->d.obj, unibuf, 0);
     return v;
@@ -531,7 +531,7 @@ const char* Jsi_ValueToString(Jsi_Interp *interp, Jsi_Value *v, int *lenPtr)
     if (!v)
         goto done;
     if (lenPtr) *lenPtr = 0;
-    char unibuf[200];
+    char unibuf[JSI_MAX_NUMBER_STRING*2];
     switch(v->vt) {
         case JSI_VT_STRING:
             ntxt = v->d.s.str;
@@ -1182,7 +1182,7 @@ Jsi_Value* jsi_ValueSubscript(Jsi_Interp *interp, Jsi_Value *target, Jsi_Value *
             if (Jsi_ValueIsString(interp, key)) {
                 char *kstr = Jsi_ValueString(interp, key, NULL);
                 if (!Jsi_Strcmp(kstr,"call") || !Jsi_Strcmp(kstr,"apply") || !Jsi_Strcmp(kstr,"bind")) {
-                    char fbuf[100];
+                    char fbuf[JSI_MAX_NUMBER_STRING];
                     snprintf(fbuf, sizeof(fbuf), "Function.%s", kstr);
                     Jsi_Value *vv = Jsi_NameLookup(interp, fbuf);
                     if (vv)
@@ -1379,7 +1379,7 @@ Jsi_RC Jsi_ValueInsertArray(Jsi_Interp *interp, Jsi_Value *target, int key, Jsi_
         }
         return JSI_ERROR;
     }
-    char unibuf[100];
+    char unibuf[JSI_MAX_NUMBER_STRING];
     Jsi_NumberItoA10(key, unibuf, sizeof(unibuf));
     Jsi_ObjInsert(interp, obj, unibuf, val, flags);
     return JSI_OK;

programming_language: C++
filename: jsiWebSocket.c
change_type: ModificationType.MODIFY
diff: @@ -208,7 +208,7 @@ typedef struct { /* Per session connection (to each server) */
     Jsi_DString recvBuf; // To buffer recv when recvJSON is true.
     Jsi_Value *onClose, *onFilter, *onRecv, *onUpload, *onGet, *onUnknown, *rootdir, *headers;
     char *lastData;
-    char key[100]; // Lookup key.
+    char key[JSI_MAX_NUMBER_STRING]; // Lookup key.
 #if (LWS_LIBRARY_VERSION_MAJOR>1)
     char filename[PATH_MAX];
     long file_length;
@@ -569,7 +569,7 @@ static int
 jsi_wsGetHeaders(jsi_wsPss *pss, struct lws *wsi, Jsi_DString* dStr, int lens[], int hmax)
 {
     int n = 0, i = 0, nlen;
-    char buf[1000];
+    char buf[JSI_BUFSIZ];
     const char *cp;
     while ((cp = (char*)lws_token_to_string((enum lws_token_indexes)n))) {
         int len = lws_hdr_copy(wsi, buf, sizeof(buf), ( enum lws_token_indexes)n);
@@ -1344,7 +1344,7 @@ static int jsi_wsHttp(Jsi_Interp *interp, jsi_wsCmdObj *cmdPtr, struct lws *wsi,
     Jsi_DSFree(&sStr);
     if (cmdPtr->debug>1)
         fprintf(stderr, "FILE: %s in %s | %s\n", buf, cmdPtr->curRoot, Jsi_ValueString(interp, cmdPtr->rootdir, NULL));
-    char extBuf[100], *cpde = Jsi_Strrchr(buf, '/');
+    char extBuf[JSI_BUFSIZ], *cpde = Jsi_Strrchr(buf, '/');
     isJsiWeb = (cpde && cmdPtr->jsiFnPattern && Jsi_GlobMatch(cmdPtr->jsiFnPattern, cpde+1, 0));
     bool isgzip = 0;
     if (!ext || !ext[1])
@@ -1836,7 +1836,7 @@ static int jsi_wscallback_http(struct lws *wsi,
         if (cmdPtr->post) {
             unsigned char **p = (unsigned char **)in, *end = (*p) + len;
             int n = 0;
-            char buf[100];
+            char buf[JSI_MAX_NUMBER_STRING];
             Jsi_ValueString(interp, cmdPtr->post, &n);
             snprintf(buf, sizeof(buf), "%d", n);
 
@@ -2228,7 +2228,7 @@ jsi_wscallback_websock(struct lws *wsi,
     case LWS_CALLBACK_CLIENT_ESTABLISHED:
     case LWS_CALLBACK_ESTABLISHED:
         if (cmdPtr->bufferPwr2>0) {
-            char nbuf[100];
+            char nbuf[JSI_MAX_NUMBER_STRING];
             snprintf(nbuf, sizeof(nbuf), "%d", cmdPtr->bufferPwr2);
             lws_set_extension_option(wsi, "permessage-deflate", "rx_buf_size", nbuf);
             lws_set_extension_option(wsi, "permessage-deflate", "tx_buf_size", nbuf);
@@ -2870,7 +2870,7 @@ static Jsi_RC WebSocketVersionCmd(Jsi_Interp *interp, Jsi_Value *args, Jsi_Value
     const char *verStr = NULL;
     verStr = lws_get_library_version();
     if (verStr) {
-        char buf[100], *cp;
+        char buf[JSI_MAX_NUMBER_STRING], *cp;
         snprintf(buf, sizeof(buf), "%s", verStr);
         cp = Jsi_Strchr(buf, ' ');
         if (cp) *cp = 0;

programming_language: C