fix: prevent stack buffer overflow in handle_name

[hacktron-app-stg]

Vulnerability

handle_name in parser.c copied the attacker-controlled command-line argument (argv[1], passed as input) into a fixed 64-byte stack buffer using strcpy(), which does no length checking. Supplying an argument longer than 63 bytes overflows name, corrupting adjacent stack data including the saved frame pointer and return address — a classic high-severity stack buffer overflow (DoS / potential arbitrary code execution).

Taint path: main → handle_name(argv[1]) → strcpy(name, input).

Fix

Replaced the unbounded strcpy with a bounded, always-NUL-terminating copy:

snprintf(name, sizeof(name), "%s", input);

This truncates any input longer than the buffer instead of writing out of bounds, and keeps the original output format for normal input.

Verification

• Confirmed the vulnerability by inspecting the source: strcpy into char name[64] from untrusted argv[1].
• Compiled with gcc -c parser.c after the change — the object file builds successfully. (Remaining -Wformat-security/gets warnings correspond to separate, out-of-scope findings in the same file and were intentionally not modified.)

---

Automated fix by Hacktron for finding: https://staging.hacktron.ai/testestesttest/findings/452edc0b-bfd2-415c-a613-564947642227