{"record":{"id":"3eaeff626fe33bec","repo":"MuntashirAkon/AppManager","slug":"error-buffer-overflow-on-exec-jar-path-n","errorCode":null,"errorMessage":"Error! Buffer overflow on exec_jar_path.\\n","messagePattern":"Error! Buffer overflow on exec_jar_path\\.\\\\n","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"app/src/main/cpp/run_server.c","lineNumber":106,"sourceCode":"\n    // Validate Paths\n    if (!is_safe_string(am_jar_name) || !is_safe_string(main_jar_name) || !is_safe_string(app_id) ||\n        !is_safe_string(user_id)) {\n        fprintf(stderr, \"Error! Invalid characters in arguments.\\n\");\n        return 1;\n    }\n\n    // Validate debug and bgrun\n    if ((strcmp(debug, \"0\") != 0 && strcmp(debug, \"1\") != 0)) {\n        fprintf(stderr, \"Error! debug must be either 0 or 1.\\n\");\n        return 1;\n    }\n\n    // /data/local/tmp/am.jar\n    char exec_jar_path[512];\n    if (snprintf(exec_jar_path, sizeof(exec_jar_path), \"%s/%s\", TMP_PATH, am_jar_name) >=\n        sizeof(exec_jar_path)) {\n        fprintf(stderr, \"Error! Buffer overflow on exec_jar_path.\\n\");\n        return 1;\n    }\n\n    // /data/local/tmp/main.jar\n    char main_jar_path[512];\n    if (snprintf(main_jar_path, sizeof(main_jar_path), \"%s/%s\", TMP_PATH, main_jar_name) >=\n        sizeof(main_jar_path)) {\n        fprintf(stderr, \"Error! Buffer overflow on main_jar_path.\\n\");\n        return 1;\n    }\n\n    // Prioritized list of fallback source paths\n    char am_jar_fallbacks[4][512];\n    snprintf(am_jar_fallbacks[0], sizeof(am_jar_fallbacks[0]), \"/sdcard/Android/data/%s/cache/%s\",\n             app_id,\n             am_jar_name);\n    snprintf(am_jar_fallbacks[1], sizeof(am_jar_fallbacks[1]),\n             \"/storage/emulated/%s/Android/data/%s/cache/%s\",","sourceCodeStart":88,"sourceCodeEnd":124,"githubUrl":"https://github.com/MuntashirAkon/AppManager/blob/0152f468fc9463ee02dc2ca83f6fe4989a2c4ca5/app/src/main/cpp/run_server.c#L88-L124","documentation":"Guard after snprintf in main(): formatting TMP_PATH plus the am.jar file name into the 512-byte exec_jar_path buffer exceeded its size, so the resulting path would have been truncated or overrun. Typically fired when the supplied am_jar_name argument is unusually long; the process exits rather than exec'ing a corrupted path.","triggerScenarios":"TMP_PATH plus \"/\" plus am_jar_name totals 512 or more bytes, i.e. am_jar_name alone is longer than roughly 512 minus len(TMP_PATH) - 1 characters.","commonSituations":"Extremely long generated or hashed jar filenames; nested subdirectories smuggled into am_jar_name; TMP_PATH reconfigured to a long custom path.","solutions":["Shorten am_jar_name on the caller side (keep filenames well under 400 characters)","Increase the buffer size (e.g. char exec_jar_path[1024] or PATH_MAX) in run_server.c and rebuild","Validate filename length in app code before exec"],"exampleFix":"// before\nchar exec_jar_path[512];\n// after\nchar exec_jar_path[PATH_MAX];","handlingStrategy":"validation","validationCode":"String path = TMP_PATH + \"/\" + amJarName;\nif (path.length() >= 512)\n    throw new IllegalArgumentException(\"am_jar_name too long (path would exceed 512 bytes)\");","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Cap generated jar filename length (e.g. <= 128 chars)","Avoid embedding directory components in jar name arguments","Recheck limits whenever TMP_PATH changes"],"tags":["buffer-overflow","path-length","native"],"backgroundTag":"value-out-of-range","analyzedSha":"0152f468fc9463ee02dc2ca83f6fe4989a2c4ca5","analyzedAt":"2026-09-12T14:03:37.243Z","contentChangedAt":"2026-09-12T14:03:37.243Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}