PLSysSec / PLSysSec/rlbox

example should guard against null string pointer

Open
#44 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C++
Stars
319
Forks
24
PR merge metrics
No merged PRs in 30d

Description

I was trying out the "hello world" example in rlbox, and wanted to confirm that it guards against the library returning garbage. When I changed call_cb() in mylib.c to invoke cb(NULL), running hello crashed with a segfault.

As far as I can tell, the example doesn't seem to properly guard against the library function call_cb passing a null string to the cb() callback, in the verifier that hello_cb() passes to copy_and_verify_string.

It would be good if the example showed what kinds of library mis-behavior the validators guard against (maybe I'm confused about NULL being a misbehavior that rlbox is guarding against?), and/or guard against the library returning a null string pointer.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the hello world example, especially hello_cb(), copy_and_verify_string, and the call_cb() implementation in mylib.c. Reproduce the segfault with call_cb() invoking cb(NULL), then clarify the expected validator behavior and update the example so its handling of a null string is demonstrated and verified.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.