Repository navigation
Guard C++ buffer and zone size arithmetic against wraparound - #1192
Open
vera-rubin wants to merge 1 commit into
Open
vera-rubin wants to merge 1 commit into
vera-rubin wants to merge 1 commit into
Conversation
Apply the size checks that msgpack#1191 added to the C buffers and zone to their C++ counterparts, so a size near SIZE_MAX is rejected with std::bad_alloc instead of wrapping to a small value: - sbuffer::expand_buffer(): m_size + len (used by write() and read_from()). - vrefbuffer::append_ref() and migrate(): the doubled iovec count and the realloc size. - zone::allocate_align(): size + the alignment padding. - zone finalizer_array::push_expand(): the doubled finalizer count and the realloc size (cpp11_zone.hpp, cpp03_zone.hpp and its erb template). The checks use the std::numeric_limits<std::size_t>::max() - x form already used by the unpacker. Behaviour for in-range sizes is unchanged. Add tests for sbuffer and zone.
|
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## cpp_master #1192 +/- ##
==============================================
- Coverage 85.36% 79.85% -5.52%
==============================================
Files 80 80
Lines 5099 5803 +704
Branches 507 634 +127
==============================================
+ Hits 4353 4634 +281
- Misses 746 1169 +423 🚀 New features to boost your workflow:
|
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This applies the size checks from #1191 (C buffers and zone) to the C++ headers. A grow request near SIZE_MAX now throws std::bad_alloc instead of letting the size arithmetic wrap around:
sbuffer::expand_buffer():m_size + len(used bywrite()andread_from()).vrefbuffer::append_ref()andmigrate(): the doubled iovec count and the realloc size.zone::allocate_align(): size plus the alignment padding.finalizer_array::push_expand(): the doubled count and the realloc size (cpp11_zone.hpp, cpp03_zone.hpp and the erb template).The checks use the same
std::numeric_limits<...>::max() - xform as the unpacker. Sizes in range behave as before. New tests in test/buffer.cpp and test/zone.cpp check that oversized requests throw and leave the object usable.If it lands, we may submit it to Google's Patch Rewards program, and we'd be glad to share any reward with the maintainers.
— ChipLab