Executive brief
CodeChecker is a static analysis tool used to inspect source code for defects. A flawed fix for a prior buffer overflow vulnerability introduced a new stack buffer overflow in the log-gathering component that triggers on every invocation when processing file paths, potentially allowing denial of service or local code execution.
Technical details
This is an out-of-bounds write (CWE-787) in ldlogger-tool-gcc.c where a prior strcpy overflow fix using safe_strcpy() was incomplete. The vulnerable code passes fullPath+2 (leaving 4,094 bytes available) as the destination to safe_strcpy() with a size argument of PATH_MAX (4,096 bytes). The safe_strcpy() function wraps strncpy(), which NUL-pads to the full requested size, writing 4,096 bytes into a 4,094-byte window—a deterministic 2-byte stack overflow on every CodeChecker invocation. Attack vector is local; the condition is reachable via the CC_LOGGER_DEF_DIRS environment variable with ordinary input paths (no crafting required). The overflow writes only NUL bytes, limiting exploitability, but stack corruption is still achievable. No patch has been released.
Affected products
- Ericsson CodeChecker 6.26.2 through 6.28.2
Timeline
- 2026-08-25: disclosed
- 2026-08-28: advisory