vbox/src/VBox/Devices/PC/ipxe/src/drivers/bus/isa_ids.c:23: off by one error ?

[dcb]

vbox/src/VBox/Devices/PC/ipxe/src/drivers/bus/isa_ids.c:23]: (error) Buffer is accessed out of bounds: buf

Source code is

sprintf ( &buf[3], "%04x", bswap_16 ( product ) );

but

static char buf[7];

so buf needs to be one larger to hold 3 + 4 + 1 (zero) bytes.

[Klaus Espenlaub]

Is this serious? Swamping our bug tracker with 3rd party software bugs (mostly for code which isn't compiled!) is wasting everyone's time. Blindly creating a ticket for every theoretical issue printed by some static code analysis tool isn't helpful.

It would've been useful if you dropped a note with a summary and otherwise worked with the upstream projects.