Fix CWE-134 format string vulnerability in netcomplexity.cc

[Copilot]

strerror(errno) was being passed directly as the format argument to the error constructor (which calls vsnprintf), making it a non-constant format string. If strerror() ever returns a string containing % characters, this triggers undefined behavior and is potentially exploitable (CWE-134).

Changes

• src/netcomplexity.cc — Replaced 8 occurrences of throw error(strerror(errno)) with an explicit format string:

// Before
throw error(strerror(errno));

// After
throw error("%s", strerror(errno));

This ensures the format argument is always a compile-time literal, with strerror()'s output treated purely as data.

---

This change is 

[Copilot]

Pull request overview

Addresses a potential CWE-134 format-string vulnerability by ensuring strerror(errno) is never used as a printf-style format string when constructing ecolab::error (which internally calls vsnprintf).

Changes:

• Replaced throw error(strerror(errno)) with throw error("%s", strerror(errno)) in the affected error paths in src/netcomplexity.cc.
• Ensured strerror() output is treated as data (string argument) rather than a format string.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.