Record the online bug solving list (unfinished to be continued 7/4)

One 、sprintf Caused by memory out of bounds

A packet sent by the player client failed to unpack , But I don't know why , Therefore, a function is added to send the wrong data package with 16 Binary output to log Function of

char *buffer = calloc(sz*2+1, sizeof(char));

First allocate a piece of memory , The length is dump Data length of double plus one . Then the cycle

sprintf(buffer+i*2, "%02x", data[i]);

This is what we haven't noticed for several times bug Where ：data yes const char type , The signed . When data[i] When it is a negative number , %02x Not necessarily only output 3 Bytes ( Don't forget the end of the string \0).buffer This memory is written out of bounds

• problem
  When the last character is negative Just crossed the line More than two characters Get the tail 0 It's covered So the question is ,

• solve
  Change to snprintf or

sprintf(buffer+i*2, "%02x", (unsigned char)data[i]);