CHERIoT-Platform / CHERIoT-Platform/network-stack
SmallTable copies too few bytes when removing an item
- Dominant language
- C++
- Stars
- 9
- Forks
- 14
- Avg merge
- 6d 17h
- Merged PRs (30d)
- 1
Description
1. Problem
The pointer version of `remove()` contains:
```cpp
memmove(element,
element + 1,
size() - ((reinterpret_cast(element + 1) -
reinterpret_cast(base())) /
sizeof(T)));
```
[`[SmallTable::remove(T *)](https://github.com/CHERIoT-Platform/network-stack/blob/58425e6a1c65c4357b037aa817ba492e7a8fa70b/lib/firewall/firewall.cc#L275-L287)`](https://github.com/CHERIoT-Platform/network-stack/blob/58425e6a1c65c4357b037aa817ba492e7a8fa70b/lib/firewall/firewall.cc#L275-L287)
The last value is the number of items left. but `memmove()` expects the number of bytes.
2. Why is it bad?
If `T` is larger than one byte, the code copies too little data. This can damage the next firewall rules in the table.
This function is used here:
```cpp
table.remove(&tuple);
```
[[Firewall use](https://github.com/CHERIoT-Platform/network-stack/blob/58425e6a1c65c4357b037aa817ba492e7a8fa70b/lib/firewall/firewall.cc#L625-L630)](https://github.com/CHERIoT-Platform/network-stack/blob/58425e6a1c65c4357b037aa817ba492e7a8fa70b/lib/firewall/firewall.cc#L625-L630)
3. Suggested fix
Multiply the number of items by `sizeof(T).
Contributor guide
No contributing guide indexed for this repository
Research direction
Open lib/firewall/firewall.cc at SmallTable::remove(T*) around lines 275-287, then inspect its use around lines 625-630. Verify the removal preserves all subsequent firewall-rule data, and confirm the corrected behavior with the repository's existing tests or checks.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- networking, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 86/100