CVE-2026-58106: Incomplete fix for CVE-2025-40843: safe_strcpy is called with PATH_MAX into fullPath+2, writing 2 bytes past the buffer on every CodeChecker log invocation
CVE-2025-40843 https://github.com/advisories/GHSA-5xf2-f6ch-6p8r was fixed by replacing unchecked strcpy() with a bounded safestrcpy() helper. At ldlogger-tool-gcc.c:129 the destination passed to that helper is fullPath + 2, but the size passed down is the full PATHMAX. safestrcpy() is strncpy(), which NUL-pads the destination out to the whole n, so this site writes 4096 bytes into the 4094 that remain — a 2-byte stack overflow on every invocation, independent of the input path's length.
This issue affects CodeChecker: through 6.28.2.
Affected Software
Event History
Frequently Asked Questions
Which CodeChecker versions are affected?
CodeChecker versions through 6.28.2 are affected.
Does exploitation depend on supplying an unusually long path?
No. The overflow occurs on every CodeChecker log invocation regardless of the input path length, because the copy routine NUL-pads to PATH_MAX bytes while only PATH_MAX minus 2 bytes remain in the destination.
How large is the overflow?
The operation writes 4096 bytes into a destination with 4094 bytes remaining, causing a 2-byte stack overflow.