Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Potential uninitialized memory access in mesalink_BIO_new_mem_buf #55

Open
shinmao opened this issue Apr 13, 2024 · 0 comments
Open

Potential uninitialized memory access in mesalink_BIO_new_mem_buf #55

shinmao opened this issue Apr 13, 2024 · 0 comments

Comments

@shinmao
Copy link

shinmao commented Apr 13, 2024

Hi, I found that the function mesalink_BIO_new_mem_buf might incorrectly assume buf_ptr points to any type that has non-zero length (all the example cases also show the assumption); however, it ignores the case that buf_ptr could also point to struct type.

pub extern "C" fn mesalink_BIO_new_mem_buf<'a>(
buf_ptr: *mut c_void,
len: c_int,
) -> *mut MESALINK_BIO<'a> {
if buf_ptr.is_null() {
return ptr::null_mut();
}
let buflen = if len < 0 {
unsafe { libc::strlen(buf_ptr as *const c_char) }
} else {
len as usize
};
let buf_ptr = buf_ptr as *mut u8;
let buf = unsafe { slice::from_raw_parts_mut(buf_ptr, buflen) };

Even in C, the struct could also contain padding bytes, which means the slice created at line 733 might point to uninitialized padding bytes. We consider that the function could add pre-condition check to make sure buf_ptr is kind of plain old data.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant