CodeQL cpp/overrunning-write-with-float flagged app/bin/cars/careditdlg.c:1526 and :1528 in CarDlgUpdate(): sprintf(carDlgPurchPriceStr, "%0.2f", carDlgPurchPrice) and the equivalent for carDlgCurrPriceStr. Both target buffers are char[STR_SIZE] (256 bytes); both source values are FLOAT_T (double). %f formatting of an arbitrary double has no upper bound on output length (DBL_MAX needs ~309 digits before the decimal point) -- for realistic car-price values this never overflows, but nothing in the type constrains the value, so it is a genuine (if practically edge-case) fixed-buffer overflow, the same class of bug this project already treats seriously (SF #709). Fix: sprintf -> snprintf(..., STR_SIZE, ...), matching the snprintf(STR_SIZE) pattern already used elsewhere in this same file (careditdlg.c:2157). No behavior change for realistic values. Found via PR #114's CodeQL check (first genuinely new finding surfaced by that PR, not the previously-documented genhelp.c/genmessages.c path-injection false-positive pattern).
Anonymous
