{"record":{"id":"a15e79ae6739927a","repo":"MuntashirAkon/AppManager","slug":"error-buffer-overflow-on-args-buf-n","errorCode":null,"errorMessage":"Error! Buffer overflow on args_buf.\\n","messagePattern":"Error! Buffer overflow on args_buf\\.\\\\n","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"app/src/main/cpp/run_server.c","lineNumber":189,"sourceCode":"            resolved_main_jar_path = main_jar_fallbacks[i];\n            break;\n        }\n    }\n    if (resolved_main_jar_path == NULL) {\n        fprintf(stderr, \"Error! %s could not be found or copied.\\n\", main_jar_name);\n        return 1;\n    }\n    // Fix ownership\n    if (chown(main_jar_path, uid, gid) != 0) {\n        fprintf(stderr, \"Warning: chown failed: %s\\n\", strerror(errno));\n        // Although it failed, still proceed\n    }\n\n    // Build argument for am.jar\n    char args_buf[2048];\n    if (snprintf(args_buf, sizeof(args_buf), \"path:%s,token:%s,app:%s,bgrun:%s,debug:%s\",\n                 port, token, app_id, bgrun, debug) >= sizeof(args_buf)) {\n        fprintf(stderr, \"Error! Buffer overflow on args_buf.\\n\");\n        unlink(exec_jar_path);\n        return 1;\n    }\n\n    printf(\"Resolved Jar path: %s\\n\", resolved_am_jar_path);\n    printf(\"Args: %s\\n\", args_buf);\n\n    // Execute app_process\n    if (setenv(\"CLASSPATH\", exec_jar_path, 1) != 0) {\n        fprintf(stderr, \"Error setting CLASSPATH\\n\");\n        unlink(exec_jar_path);\n        return 1;\n    }\n\n    int extra_args_count = argc - 8;\n    int exec_argc = 6 + extra_args_count;\n    char **exec_argv = malloc(sizeof(char *) * exec_argc);\n    if (!exec_argv) {","sourceCodeStart":171,"sourceCodeEnd":207,"githubUrl":"https://github.com/MuntashirAkon/AppManager/blob/0152f468fc9463ee02dc2ca83f6fe4989a2c4ca5/app/src/main/cpp/run_server.c#L171-L207","documentation":"The composed argument string \"path:<port>,token:<token>,app:<app_id>,bgrun:<bgrun>,debug:<debug>\" exceeded the 2048-byte args_buf, so snprintf truncated it and the binary aborts (cleaning up the copied am.jar via unlink).","triggerScenarios":"Combined lengths of port + token + app_id plus fixed format text reach 2048 bytes — typically a very long token or app_id.","commonSituations":"Long JWT/opaque tokens passed as <token>; verbose app_ids; future fields appended to the format string without growing the buffer; callers embedding extra data into token.","solutions":["Shorten the token/app_id values on the caller side (tokens should be compact)","Increase args_buf to e.g. 4096 or 8192 in run_server.c and rebuild","Validate combined argument length in the app before exec and reject oversized values"],"exampleFix":"// before\nchar args_buf[2048];\n// after\nchar args_buf[8192];","handlingStrategy":"validation","validationCode":"String argsStr = String.format(\"path:%s,token:%s,app:%s,bgrun:1,debug:%s\",\n        port, token, appId, debug);\nif (argsStr.length() >= 2048)\n    throw new IllegalArgumentException(\"combined run_server arguments exceed 2048 bytes; shorten token/app_id\");","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep tokens compact (strip headers/whitespace)","Validate port+token+app_id combined length before exec","Grow args_buf in the C source if the format string gains fields","Never embed auxiliary payloads inside the token field"],"tags":["buffer-overflow","token-size","native"],"backgroundTag":"value-out-of-range","analyzedSha":"0152f468fc9463ee02dc2ca83f6fe4989a2c4ca5","analyzedAt":"2026-09-12T14:03:37.243Z","contentChangedAt":"2026-09-12T14:03:37.243Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}