From 2e55f86bb38d9215e370abb41767947964426ef6 Mon Sep 17 00:00:00 2001
From: Tyler Yankee <tyler.yankee@kitware.com>
Date: Sat, 16 May 2026 15:57:34 -0400
Subject: [PATCH] cmHexFileConverter: Avoid stack buffer overflow

Prevent overflow on maliciously-crafted Motorola S1 record files which
have a maximum line length over the 256-byte maximum.
---
 Source/cmHexFileConverter.cxx           | 4 ++++
 Tests/StringFileTest/CMakeLists.txt     | 4 ++++
 Tests/StringFileTest/s1-max-length.srec | 2 ++
 3 files changed, 10 insertions(+)
 create mode 100644 Tests/StringFileTest/s1-max-length.srec

diff --git a/Source/cmHexFileConverter.cxx b/Source/cmHexFileConverter.cxx
index 3036473e01..2202a838ed 100644
--- a/Source/cmHexFileConverter.cxx
+++ b/Source/cmHexFileConverter.cxx
@@ -45,6 +45,10 @@ static bool OutputBin(FILE* file, char const* buf, unsigned int startIndex,
       success = false;
       break;
     }
+    if (outBufCount >= sizeof(outBuf)) {
+      success = false;
+      break;
+    }
     outBuf[outBufCount] = static_cast<char>(convertedByte & 0xff);
     outBufCount++;
   }
diff --git a/Tests/StringFileTest/CMakeLists.txt b/Tests/StringFileTest/CMakeLists.txt
index f72dafd788..3c9570d9f4 100644
--- a/Tests/StringFileTest/CMakeLists.txt
+++ b/Tests/StringFileTest/CMakeLists.txt
@@ -55,6 +55,10 @@ else()
     "file(STRINGS) incorrectly read from srec file [${infile_strings}]")
 endif()
 
+# this file is crafted to contain the maximum line length and trigger a buffer
+# overflow
+file(STRINGS "${CMAKE_CURRENT_SOURCE_DIR}/s1-max-length.srec" infile_strings)
+
 #this file has utf-8 content
 file(STRINGS test.utf8 infile_strings ENCODING UTF-8)
 list(LENGTH infile_strings content_len)
diff --git a/Tests/StringFileTest/s1-max-length.srec b/Tests/StringFileTest/s1-max-length.srec
new file mode 100644
index 0000000000..e7dcee3cce
--- /dev/null
+++ b/Tests/StringFileTest/s1-max-length.srec
@@ -0,0 +1,2 @@
+S107000001020304EE
+S1FF000041414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414100