myxce/.wolf/bugs/bug-1703.md

id	status	status_updated	status_note	component	severity	timestamp	last_seen	occurrences	files	tags	related	fix_commits	legacy	gitea_issue	gitea_synced_status	gitea_synced_hash
bug-1703	fixed	2026-09-28		controller	unknown	2026-08-26T09:32:18Z	2026-09-19T09:00:00Z	1	src/harness/test.c	controller testsuite xce_test cmd_jobsub buffer-overflow memory-safety cli-ux-audit	bug-1702	da1a663f	true	300	fixed	cb775a86ae2d

bug-1703: cmd_jobsub's -n <min>,<max> parsing copies the min-value substring into a fixed 64-byte stack…

Description

cmd_jobsub's -n <min>,<max> parsing copies the min-value substring into a fixed 64-byte stack buffer with an unbounded strncpy (length = bytes before ',' in the user-supplied argument, never clamped to sizeof(buf)). A -n argument with 64+ characters before the comma overflows the stack buffer.

Environment

Not recorded (migrated from buglog.json).

Reproduction

Not recorded (migrated from buglog.json).

Root cause

Same pattern as bug-1702: strncpy(buf, optarg, (int)(p - optarg)) with no bound check against sizeof(buf).

Fix

jobsub's -n now goes through cmdutil_parse_ntasks(), which parses min and max in place (no copy into a buffer) and refuses anything but 1 <= min <= max, with a usage error.

Verification

• Test: test_jobsub_overlong_ntasks_rejected_without_overflow in src/harness/testsuite/test_test_cli.c: RED before the fix (ASAN stack-buffer-overflow, WRITE of size 100), GREEN after; plus the parse_ntasks cases in src/harness/testsuite/test_cmdutil.c
• Suites: harness 6/6 (asan): harness_unit_test 141/0, cmdutil 14/0, resval_typeresolve 7/0, joblist_display 22/0, join_worker_args 7/0, listrow_json 12/0
• Live: n/a; xce_test is a client tool and every case above runs without a controller

References

• Related: bug-1702