Merge pull request #2739 from vulgraph/backport/CVE-2024-10964-v2.6

v2.6: bound plugin-library copy (CVE-2024-10964)
plugin:buffer overflow
2026-10-29 23:19:18 +08:00 · 2026-09-24 09:39:39 +08:00 · 2026-04-24 00:27:38 +08:00 · 2025-08-27 17:24:18 +08:00 · 2025-08-27 09:23:33 +00:00
2 changed files with 2 additions and 2 deletions
@@ -414,7 +414,7 @@ const neu_plugin_module_t neu_plugin_module = {
    .kind            = NEU_PLUGIN_KIND_SYSTEM,
    .type            = NEU_NA_TYPE_APP,
    .display         = true,
-    .single          = false,
+    .single          = true,
    .single_name     = "monitor",
 };

@@ -40,7 +40,7 @@ void handle_add_plugin(nng_aio *aio)

            header.ctx  = aio;
            header.type = NEU_REQ_ADD_PLUGIN;
-            strcpy(cmd.library, req->library);
+            strncpy(cmd.library, req->library, NEU_PLUGIN_LIBRARY_LEN);
            ret = neu_plugin_op(plugin, header, &cmd);
            if (ret != 0) {
                NEU_JSON_RESPONSE_ERROR(NEU_ERR_IS_BUSY, {
Author	SHA1	Message	Date
fengzeroz	ee9da15891	Merge pull request #2739 from vulgraph/backport/CVE-2024-10964-v2.6 v2.6: bound plugin-library copy (CVE-2024-10964)	2026-09-24 09:39:39 +08:00
xiang.zhou	80caae1095	plugin:buffer overflow (cherry picked from commit `3e3a583d72`)	2026-04-24 00:27:38 +08:00
fengzeroz	ec00415177	Merge pull request #2555 from fengzeroz/v2.6 #2501: Prevent the creation of monitor node	2025-08-27 17:24:18 +08:00
fengzero	ae36da9c94	#2501 : Prevent the creation of monitor node	2025-08-27 09:23:33 +00:00