chenlin/Mujoco_WASM
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Improve bounds checking in engine_util_solve.c.

Browse Source 
Add checks to ensure `snprintf` does not write beyond the allocated log buffer size, preventing buffer overflows.

Fixes #2661, #2673

PiperOrigin-RevId: 853643867
Change-Id: Ibdc47810158466dc961767284ac297df98916dac
This commit is contained in:
Yuval Tassa
2026-01-08 02:42:05 -08:00
committed by Copybara-Service
parent a92574837e
commit 8f5eb1e4f4
1 changed files with 10 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/engine/engine_util_solve.c
+10 -7
View File
@@ -1534,12 +1534,15 @@ int mju_boxQPoption(mjtNum* res, mjtNum* R, int* index, // outputs
// print iteration info
if (log) {
logptr += snprintf(log+logptr, logsz-logptr,
"iter %-3d: |grad|: %-8.2g reduction: %-8.2g improvement: %-8.4g "
"linesearch: %g^%-2d factorized: %d nfree: %d\n",
iter+1, mju_sqrt(norm2), oldvalue-value, improvement,
backtrack, nstep-1, factorize, nfree);
if (log && logptr < logsz) {
int written = snprintf(log+logptr, logsz-logptr,
"iter %-3d: |grad|: %-8.2g reduction: %-8.2g improvement: %-8.4g "
"linesearch: %g^%-2d factorized: %d nfree: %d\n",
iter+1, mju_sqrt(norm2), oldvalue-value, improvement,
backtrack, nstep-1, factorize, nfree);
if (written > 0) {
logptr = mjMIN(logptr + written, logsz);
}
}
// accept candidate
@@ -1552,7 +1555,7 @@ int mju_boxQPoption(mjtNum* res, mjtNum* R, int* index, // outputs
}
// print final info
if (log) {
if (log && logptr < logsz) {
snprintf(log+logptr, logsz-logptr, "BOXQP: %s.\n"
"iterations= %d, factorizations= %d, |grad|= %-12.6g, final value= %-12.6g\n",
status_string[status+1], iter, nfactor, mju_sqrt(norm2), value);