Skip to content
CVE PROGRAM SOURCE RECORD2.0 Low

CVE-2026-58106

Incomplete fix for CVE-2025-40843: safe_strcpy is called with PATH_MAX into fullPath+2, writing 2 bytes past the buffer on every CodeChecker log invocation

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
ERIC

Description

CVE-2025-40843 https://github.com/advisories/GHSA-5xf2-f6ch-6p8r  was fixed by replacing unchecked strcpy() with a bounded safe_strcpy() helper. At ldlogger-tool-gcc.c:129 the destination passed to that helper is fullPath + 2, but the size passed down is the full PATH_MAX. safe_strcpy() is strncpy(), which NUL-pads the destination out to the whole n, so this site writes 4096 bytes into the 4094 that remain — a 2-byte stack overflow on every invocation, independent of the input path's length. This issue affects CodeChecker: through 6.28.2.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Ericsson CodeChecker

Default version status: unaffected

  • 0 to ≤ 6.28.2affected

References