stack-bounds-format-auditinglisted

# Stack-Bounds Format Auditing (C/C++) Find, validate, and remediate stack buffer overflows in C/C++ string-formatting and serialization routines where the size argument to a bounded function is incorrect — specifically when destination pointers advance without a corresponding decrement to the remaining buffer size. Targets and codebases must be within the authorized scope of your assessment. --- ## When to Use - Auditing C/C++ network protocol serializers, deserializers, and packet formatters. - Reviewing URL/URI generators, query-string builders, and header concatenation routines. - Assessing string formatting loops (`snprintf`, `swprintf`, `strncpy`, `wcsncpy`, `memcpy`) writing to fixed stack or heap buffers. - Triaging potential buffer overflows in game networking, IoT firmware, embedded systems, and IPC mechanisms. - Analyzing HackerOne report patterns similar to **#2551512** (`nn::nex::StationURL::Format` on Wii U, 3DS, and Nintendo Switch NEX clients). --- ## Reference Case: HackerOne #2551512 (Nintendo NEX `StationURL::Format`) In Nintendo's NEX network library, `nn::nex::StationURL::Format` serializes key-value connection parameters from a `std::map<String, String>` into a fixed 1024-character stack buffer (`wchar_t url[1024]`): ```cpp // Vulnerable implementation in NEX clients (HackerOne #2551512) void nn::nex::StationURL::Format() { wchar_t url[1024]; unsigned int offset = 0; unsigned int written = 0; bool writeDelimiter = false; for