Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix memory safety issues #260

Merged
merged 10 commits into from
Jan 6, 2022
Merged

Fix memory safety issues #260

Changes from 1 commit
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
ac8d760
ucl_lex_json_string: fix out-of-bounds read
alpire Jan 4, 2022
08de358
ucl_parse_value: fix out-of-bounds read
alpire Jan 4, 2022
3a94514
ucl_check_variable: fix out_len on unterminated variable
alpire Jan 4, 2022
54a5b59
ucl_inherit_handler: fix format string for non-null-terminated strings
alpire Jan 4, 2022
852f752
ucl_strnstr: fix out-of-bounds read
alpire Jan 4, 2022
f9e5446
ucl_expand_variable: fix out-of-bounds read
alpire Jan 4, 2022
a9c0965
ucl_object_copy_internal: use memcpy instead of strdup
alpire Jan 4, 2022
9e0e06f
ucl_chunk_skipc: avoid out-of-bounds read
alpire Jan 5, 2022
9b898ea
ucl_expand_single_variable: better bounds check
alpire Jan 5, 2022
110428d
ucl_object_copy_internal: null terminate keys
alpire Jan 5, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
ucl_inherit_handler: fix format string for non-null-terminated strings 
I believe this was the intent of the original format string, but two
characters got swapped. See printf docs at
https://www.gnu.org/software/libc/manual/html_node/Output-Conversion-Syntax.html#Output-Conversion-Syntax.

Fix https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25626
Fix https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33041
  • Loading branch information
@alpire
alpire committed Jan 4, 2022
commit 54a5b5943b49060d4ca7b345bc80f9b0cb2cdc94
2 changes: 1 addition & 1 deletion src/ucl_util.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1919,7 +1919,7 @@ ucl_inherit_handler (const unsigned char *data, size_t len,

/* Some sanity checks */
if (parent == NULL || ucl_object_type (parent) != UCL_OBJECT) {
ucl_create_err (&parser->err, "Unable to find inherited object %*.s",
ucl_create_err (&parser->err, "Unable to find inherited object %.*s",
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oh, I always forget about the order of * and .. In Rspamd, I have the own printf implementation which has distinction between %.*s and %*.s. But here we use a generic libc printf...

(int)len, data);
return false;
}
Expand Down