plugin: use snprintf in ubus lookup callback to prevent buffer overflow

rpc_plugin_lookup_plugin_cb() wrote the ubus object path into a
caller-supplied pointer using sprintf() with no length limit.  The
destination is a position inside a PATH_MAX buffer whose remaining
capacity depends on the length of RPC_PLUGIN_DIRECTORY; a sufficiently
long obj->path could silently overflow the buffer.

Add a namelen field to rpc_plugin_lookup_context, propagate the
remaining buffer size from the call site, and switch to snprintf().

Assisted-by: Claude:claude-sonnet-4-6
Link: https://github.com/openwrt/rpcd/pull/34
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

1 files changed, 6 insertions, 4 deletions

diff --git a/plugin.c b/plugin.c
index ea6e60f..ca267fc 100644
--- a/plugin.c
+++ b/plugin.c
@@ -23,6 +23,7 @@ static struct blob_buf buf;
 struct rpc_plugin_lookup_context {
 	uint32_t id;
 	char *name;
+	size_t namelen;
 	bool found;
 };
 
@@ -35,15 +36,15 @@ rpc_plugin_lookup_plugin_cb(struct ubus_context *ctx,
 	if (c->id == obj->id)
 	{
 		c->found = true;
-		sprintf(c->name, "%s", obj->path);
+		snprintf(c->name, c->namelen, "%s", obj->path);
 	}
 }
 
 static bool
 rpc_plugin_lookup_plugin(struct ubus_context *ctx, struct ubus_object *obj,
-                         char *strptr)
+                         char *strptr, size_t strsize)
 {
-	struct rpc_plugin_lookup_context c = { .id = obj->id, .name = strptr };
+	struct rpc_plugin_lookup_context c = { .id = obj->id, .name = strptr, .namelen = strsize };
 
 	if (ubus_lookup(ctx, NULL, rpc_plugin_lookup_plugin_cb, &c))
 		return false;
@@ -220,7 +221,8 @@ rpc_plugin_call(struct ubus_context *ctx, struct ubus_object *obj,
 
 	plugin = c->path + sprintf(c->path, "%s/", RPC_PLUGIN_DIRECTORY);
 
-	if (!rpc_plugin_lookup_plugin(ctx, obj, plugin))
+	if (!rpc_plugin_lookup_plugin(ctx, obj, plugin,
+	                              sizeof(c->path) - (plugin - c->path)))
 	{
 		rv = UBUS_STATUS_NOT_FOUND;
 		goto fail;