cobs_decode: fix buffer overflow #25
Conversation
A malformed encoding may have the overhead byte pointing to a location outside the buffer contents. This malformed encoding causes an out of bounds memory access. This commit explicitly checks the invalid condition doesn’t happen, and bails if so.
|
Ah great catch! Thanks for the patch; i'm embarrassed that I haven't gotten around to unit-testing You might have noticed that the See http://www.open-std.org/jtc1/sc22/wg14/www/docs/n1570.pdf section 6.5.6/8: So I think your PR (and other parts of my code) are technically UB. I think the only formally portable way to do this work in general is to use indices for testing these out-of-bounds checks. Anyway, of course your PR improves what's there so I'll gladly take it! Thanks so much for pitching in, I appreciate it! |
|
Oh this is funny, the CI tests that need docker are failing because your "github.actor" obviously can't use my password to pull the docker image? Could I ask you to try updating your PR to use |
|
Sorry, 6.5.8/5 is more relevant: When two pointers are compared, the result depends on the relative locations in the address space of the objects pointed to. If two pointers to object types both point to the same object, or both point one past the last element of the same array object, they compare equal. If the objects pointed to are members of the same aggregate object, pointers to structure members declared later compare greater than pointers to members declared earlier in the structure, and pointers to array elements with larger subscript values compare greater than pointers to elements of the same array with lower subscript values. All pointers to members of the same union object compare equal. If the expression P points to an element of an array object and the expression Q points to the last element of the same array object, the pointer expression Q+1 compares greater than P. In all other cases, the behavior is undefined. |
|
ah great point on UB doing raw pointer arithmetic/comparison, of course! ✅ ✅ ✅ wondering also why the standard makes the exception for the last + 1 element being a non-UB pointer value... will try changing |
|
Huh, I have no idea what's going on here with the permissions; this is frustrating. I'll just bonk it in and figure it out later :) Thanks again! |
|
Ahhh https://docs.github.com/en/actions/reference/encrypted-secrets makes it look like I need to name the token |
A malformed encoding may have the overhead byte pointing to a location outside the buffer contents. This malformed encoding causes an out of bounds memory access. This commit explicitly checks the invalid condition doesn’t happen, and bails if so.
Such malformed encoding will never be produced by a proper encoder, but someone messing with the framer doesn’t need to restrict themselves to feed only compliant encodings.