Use r_str_scanf as a safe alternative to fix gdb reg profile parsing bugs

libr/debug/p/debug_gdb.c

@@ -236,12 +236,8 @@ static RList *r_debug_gdb_map_get(RDebug* dbg) { // TODO
 		r_list_free (words);
 		free (wordstr);
 #else
-		// We assume Linux target, for now, so -
-		// 7ffff7dda000-7ffff7dfd000 r-xp 00000000 08:05 265428 /usr/lib/ld-2.25.so
-		// Android
-		// "12c00000-12c40000 rw-p 00000000 00:00 0                                  [anon:dalvik-main space (region space)]";
-		ret = sscanf (ptr, "%s %s %"PFMT64x" %*s %*s %[^\n]", &region1[2],
-			      perms, &offset, name);
+		ret = r_str_scanf (ptr, "%.s %.s %Lx %*s %*s %.[^\n]",
+			sizeof (region1) - 2, region1 + 2, sizeof (perms), perms, offset, sizeof (name), name);
 #endif
 		// eprintf ("RET = %d (%s)\n", ret, ptr);
 		if (ret == 3) {

libr/debug/p/debug_io.c

@@ -47,8 +47,9 @@ static RList *__io_maps(RDebug *dbg) {
 			if (_s_) {
 				memmove (_s_, _s_ + 2, strlen (_s_));
 			}
-			sscanf (str, "0x%"PFMT64x" - 0x%"PFMT64x" %s %s",
-				&map_start, &map_end, perm, name);
+			if (r_str_scanf (str, "0x%Lx - 0x%Lx %.s %.s", &map_start, &map_end, sizeof (perm), perm, sizeof (name), name) > 4) {
+				break;
+			}
 			if (map_end != 0LL) {
 				RDebugMap *map = r_debug_map_new (name, map_start, map_end, r_str_rwx (perm), 0);
 				r_list_append (list, map);

libr/debug/p/debug_native.c

@@ -1091,9 +1091,8 @@ static RList *r_debug_native_map_get(RDebug *dbg) {
 		}
 #if __KFBSD__
 		// 0x8070000 0x8072000 2 0 0xc1fde948 rw- 1 0 0x2180 COW NC vnode /usr/bin/gcc
-		if (sscanf (line, "%s %s %d %d 0x%s %3s %d %d",
-				&region[2], &region2[2], &ign, &ign,
-				unkstr, perms, &ign, &ign) != 8) {
+		if (r_str_scanf (line, "%.s %.s %*d %*d %*s %.s %*d %*d",
+			sizeof (region)-2, &region[2], sizeof (region2)-2, &region2[2], sizeof (perms), perms) != 3) {
 			R_LOG_ERROR ("%s: Unable to parse \"%s\"", __func__, path);
 			r_list_free (list);
 			return NULL;
@@ -1109,7 +1108,7 @@ static RList *r_debug_native_map_get(RDebug *dbg) {
 #else
 		ut64 offset = 0;
 		// 7fc8124c4000-7fc81278d000 r--p 00000000 fc:00 17043921 /usr/lib/locale/locale-archive
-		i = sscanf (line, "%s %s %08"PFMT64x" %*s %*s %[^\n]", &region[2], perms, &offset, name);
+		i = r_str_scanf (line, "%.s %.s %Lx %*s %*s %.[^\n]", sizeof (region[2]), &region[2], sizeof (perms), perms, &offset, sizeof (name), name);
 		if (i == 3) {
 			name[0] = '\0';
 		} else if (i != 4) {

libr/debug/p/native/linux/linux_coredump.c

@@ -1,6 +1,7 @@
 /* radare - LGPL - Copyright 2016-2023 - Oscar Salvador */
 
 #include <r_debug.h>
+#include <r_util.h>
 
 #if DEBUGGER
 
@@ -157,9 +158,7 @@ static proc_per_thread_t *get_proc_thread_content(int pid, int tid) {
 		int no_num;
 		char no_char;
 		ut32 no_ui;
-		sscanf (buff,  "%d %s %c %d %d %d %d %d %u %lu %lu %lu %lu"
-			"%"PFMT64x" %"PFMT64x" %ld %lu",
-			&no_num, no_str, &no_char, &no_num, &no_num, &no_num,
+		r_str_scanf (buff, "%d %.s %c %d %d %d %d %d %u %lu %lu %lu %Lx %Lx %ld %lu", &no_num, sizeof (no_str), no_str, &no_char, &no_num, &no_num, &no_num,
 			&no_num, &no_num, &no_ui, &no_lui, &no_lui, &no_lui,
 			&no_lui, &t->utime, &t->stime, &t->cutime, &t->cstime);
 		free (buff);
@@ -809,16 +808,13 @@ static proc_per_process_t *get_proc_process_content(RDebug *dbg) {
 	/* /proc/[pid]/stat */
 	/* we only need few fields which are process-wide */
 	{
-		char no_str[128];
-		long unsigned int no_lui;
-		long int no_li;
-		int no_num;
-		sscanf (buff, "%d %s %c %d %d %d %d %d %u %lu %lu %lu %lu"
-				"%lu %lu %ld %ld %ld %ld %ld",
-			&p->pid, no_str, &p->s_name, &p->ppid, &p->pgrp, &no_num,
-			&no_num, &p->sid, &p->flag, &no_lui, &no_lui, &no_lui,
-			&no_lui, &no_lui, &no_lui, &no_li, &no_li,
-			&no_li, &p->nice, &p->num_threads);
+		if (r_str_scanf (buff, "%d %*s %c %d %d %*d %*d %lu %ld",
+			&p->pid, &p->s_name, &p->ppid, &p->pgrp,
+			&p->sid, &p->flag,
+			&p->nice, &p->num_threads) < 6) {
+				free (buff);
+				return NULL;
+			}
 		free (buff);
 	}
 	if (!p->num_threads || p->num_threads < 1) {
@@ -869,7 +865,11 @@ static proc_per_process_t *get_proc_process_content(RDebug *dbg) {
 	file = r_strf ("/proc/%d/coredump_filter", dbg->pid);
 	buff = r_file_slurp (file, &size);
 	if (buff) {
-		sscanf (buff, "%hx", &filter_flags);
+		if (r_str_scanf (buff, "%hx", &filter_flags) != 1) {
+			free (p);
+			free (buff);
+			return NULL;
+		}
 		p->coredump_filter = filter_flags;
 		free (buff);
 	} else {

libr/include/r_types_base.h

@@ -293,4 +293,5 @@ static inline void *untagged_pointer_check(void *x) {
 }
 #endif
 
+
 #endif // R2_TYPES_BASE_H

libr/io/p/io_self.c

@@ -212,7 +212,9 @@ static int update_self_regions(RIO *io, int pid) {
 		}
 		path[0]='\0';
 		strcpy (region, "0x");
-		sscanf (line, "%s %s %*s %*s %*s %[^\n]", region + 2, perms, path);
+		if (r_str_scanf (line, "%.s %.s %*s %*s %*s %.[^\n]", sizeof (region) - 2, region + 2, sizeof (perms), perms, sizeof (path), path) < 6) {
+			return false;
+		}
 		pos_c = strchr (region + 2, '-');
 		if (pos_c) {
 			*pos_c++ = 0;

libr/reg/profile.c

@@ -350,9 +350,8 @@ static char *gdb_to_r2_profile(const char *gdb) {
 			r_strbuf_free (sb);
 			return false;
 		}
-		ret = sscanf (ptr, " %s %d %d %d %d %s %s", name, &number, &rel,
-			&offset, &size, type, groups);
-		// Groups is optional, others not
+		ret = r_str_scanf (ptr, "%.s %d %d %d %d %.s %.s", sizeof (name), name, &number, &rel, &offset, &size, sizeof (type), type, sizeof (groups), groups);
+		// Groups is optional, others are not
 		if (ret < 6) {
 			if (*ptr != '*') {
 				R_LOG_WARN ("Could not parse line: %s", ptr);