Skip to content

Commit 4a478b1

Browse files
authored
Fix buffer overflow in output_spikes_parallel with zero spikes (#3813)
Fix: #3812 When `num_spikes == 0`, `malloc(0)` followed by `strcpy(spike_data, "")` triggers glibc's FORTIFY_SOURCE buffer overflow detection on Linux. ## Fix - Allocate at least 1 byte: `malloc(num_bytes > 0 ? num_bytes : 1)` - Use direct assignment `spike_data[0] = '\0'` instead of `strcpy` ## Testing Reproduces in neurodamus CI (`test_v5_coreneuron_no_lfp_smoke`) on Ubuntu when tstop is too short for any cell to fire.
1 parent 8498843 commit 4a478b1

1 file changed

Lines changed: 4 additions & 2 deletions

File tree

src/coreneuron/io/output_spikes.cpp

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -217,15 +217,17 @@ static void output_spikes_parallel(const char* outpath, const SpikesInfo& spikes
217217
const int SPIKE_RECORD_LEN = 64;
218218
size_t num_spikes = spikevec_gid.size();
219219
size_t num_bytes = (sizeof(char) * num_spikes * SPIKE_RECORD_LEN);
220-
char* spike_data = (char*) malloc(num_bytes);
220+
221+
// ensure space for at least the null terminator when there are no spikes
222+
char* spike_data = (char*) malloc(std::max(num_bytes, (size_t) 1));
221223

222224
if (spike_data == nullptr) {
223225
printf("Error while writing spikes due to memory allocation\n");
224226
return;
225227
}
226228

227229
// empty if no spikes
228-
strcpy(spike_data, "");
230+
spike_data[0] = '\0';
229231

230232
// populate buffer with all spike entries
231233
char spike_entry[SPIKE_RECORD_LEN];

0 commit comments

Comments
 (0)