From 9a6e88bfd8f35210c95c039491de8d0dba27bb10 Mon Sep 17 00:00:00 2001 From: Mingjie Shen Date: Sat, 22 Apr 2023 17:13:57 -0400 Subject: [PATCH] Fix unbounded writing of sscanf '%s' may lead to buffer overflow if the width is not provided. --- tinyobj_loader_c.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tinyobj_loader_c.h b/tinyobj_loader_c.h index cbfa301..9183063 100644 --- a/tinyobj_loader_c.h +++ b/tinyobj_loader_c.h @@ -915,7 +915,7 @@ static int tinyobj_parse_and_index_mtl_file(tinyobj_material_t **materials_out, #ifdef _MSC_VER sscanf_s(token, "%s", namebuf, (unsigned)_countof(namebuf)); #else - sscanf(token, "%s", namebuf); + sscanf(token, "%4095s", namebuf); #endif material.name = my_strdup(namebuf, (size_t) (line_end - token));