stack-bounds-format-auditing

Stack-Bounds Format Auditing (C/C++)

Find, validate, and remediate stack buffer overflows in C/C++ string-formatting and serialization routines where the size argument to a bounded function is incorrect — specifically when destination pointers advance without a corresponding decrement to the remaining buffer size. Targets and codebases must be within the authorized scope of your assessment.

---

When to Use

• Auditing C/C++ network protocol serializers, deserializers, and packet formatters.
• Reviewing URL/URI generators, query-string builders, and header concatenation routines.
• Assessing string formatting loops (snprintf, swprintf, strncpy, wcsncpy, memcpy) writing to fixed stack or heap buffers.
• Triaging potential buffer overflows in game networking, IoT firmware, embedded systems, and IPC mechanisms.
• Analyzing HackerOne report patterns similar to #2551512 (nn::nex::StationURL::Format on Wii U, 3DS, and Nintendo Switch NEX clients).

---

Reference Case: HackerOne #2551512 (Nintendo NEX StationURL::Format)

In Nintendo's NEX network library, nn::nex::StationURL::Format serializes key-value connection parameters from a std::map<String, String> into a fixed 1024-character stack buffer (wchar_t url[1024]):

// Vulnerable implementation in NEX clients (HackerOne #2551512)
void nn::nex::StationURL::Format() {
    wchar_t url[1024];
    unsigned int offset = 0;
    unsigned int written = 0;
    bool writeDelimiter = false;

    for (auto param = normalParams.begin(); param != normalParams.end(); param++) {
        if (writeDelimiter) {
            // BUG: size is always 1024 regardless of offset!
            written = swprintf(url + offset, 1024, L";");
            offset += written;
        }
        // BUG: remaining buffer space is not (1024 - offset)
        written = swprintf(url + offset, 1024, L"%ls%ls%ls",
                           param->first.c_str(), L"=", param->second.c_str());
        offset += written;
        writeDelimiter = true;
    }
    SetURL(url);
}