Skip to content
This repository was archived by the owner on Apr 9, 2020. It is now read-only.

Fix problem exactly filling a buffer when encoding. #49

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Fix problem exactly filling a buffer when encoding. #49

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7ff99e3
Fix problem exactly filling a buffer when encoding.
sbertin-telular Apr 11, 2018
1377c15
Change ws.size check to an assert
sbertin-telular Apr 13, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion src/cn-encoder.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@ typedef struct _write_state
ssize_t size;
} cn_write_state;

#define ensure_writable(sz) if ((ws->offset<0) || (ws->offset + (sz) >= ws->size)) { \
#define ensure_writable(sz) if ((ws->offset<0) || (ws->size - ws->offset < (sz))) { \
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is definitely a good change...

ws->offset = -1; \
return; \
}
Expand Down Expand Up @@ -302,6 +302,7 @@ ssize_t cn_cbor_encoder_write(uint8_t *buf,
const cn_cbor *cb)
{
cn_write_state ws = { buf, buf_offset, buf_size };
if (ws.size < 0) { return -1; }
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

When would this be the case?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In normal use I would expect it would not happen, but if buf_size has the high bit set and buf_offset is non-zero the check in ensure_writable could underflow. Probably an overabundance of caution, but issue #12 made me think about what could happen in an attack situation.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would you like to see this removed? Or maybe change ws.size from ssize_t to size_t? I'd like to see the off by one error fixed. It seems there were attempts to do so since 2015 that never quite made it.

_visit(cb, _encoder_visitor, _encoder_breaker, &ws);
if (ws.offset < 0) { return -1; }
return ws.offset - buf_offset;
Expand Down