Skip to content

fix: guard vector byte-count multiplications against size overflow #38

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
orbisai0security wants to merge 2 commits into
base: master
Choose a base branch
from
+12 −0
Open

fix: guard vector byte-count multiplications against size overflow #38

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e53bd22
fix: V-001 security vulnerability
orbisai0security May 15, 2026
662cef4
fix: remove redundant count != 0 guards in overflow checks
orbisai0security May 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions Source/Misra/Std/Container/Vec.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -195,6 +195,9 @@ bool insert_range_into_vec(GenericVec *vec, const char *item_data, size item_siz
}

aligned_size = vec_aligned_size(vec, item_size);
if (aligned_size > SIZE_MAX / count) {
return false;
}
if (vec->length + count >= vec->capacity) {
if (!reserve_pow2_vec(vec, item_size, vec->capacity + count)) {
return false;
Expand Down Expand Up @@ -257,6 +260,9 @@ bool insert_range_fast_into_vec(GenericVec *vec, const char *item_data, size ite
}

aligned_size = vec_aligned_size(vec, item_size);
if (aligned_size > SIZE_MAX / count) {
return false;
}
if (vec->length + count >= vec->capacity) {
if (!reserve_pow2_vec(vec, item_size, vec->length + count)) {
return false;
Expand Down Expand Up @@ -323,6 +329,9 @@ void remove_range_vec(GenericVec *vec, void *removed_data, size item_size, size
}
}

if ((vec->length - start - count) != 0 && vec_aligned_size(vec, item_size) > SIZE_MAX / (vec->length - start - count)) {
Copy link
Copy Markdown
Owner

@brightprogrammer brightprogrammer May 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

the (vec->length - start - count) != 0 check is also redundant, MemMove returns early if provided length to move is 0.

Copy link
Copy Markdown
Author

@orbisai0security orbisai0security May 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Agreed. I missed that MemMove already handles a zero-length move by returning early, so the (vec->length - start - count) != 0 guard is redundant.

I’ll remove that condition and keep the patch focused on the overflow/underflow checks only.

Copy link
Copy Markdown

@anupamme anupamme May 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@orbisai0security can you address code review comments?

LOG_FATAL("integer overflow in remove_range_vec: aligned_size * move_count would overflow");
}
// all elements to new created space
MemMove(
// move to freed up space
Expand Down Expand Up @@ -374,6 +383,9 @@ void fast_remove_range_vec(GenericVec *vec, void *removed_data, size item_size,
}

if (elements_to_move > 0) {
if (vec_aligned_size(vec, item_size) > SIZE_MAX / elements_to_move) {
LOG_FATAL("integer overflow in fast_remove_range_vec: aligned_size * elements_to_move would overflow");
}
// Move the last 'elements_to_move' elements to the gap
MemMove(
// Move to freed up space
Expand Down