When looking up environment variables, boost process assumes the keys are of equal size
Open
- Dominant language
- C++
- Stars
- 145
- Forks
- 151
- PR merge metrics
- No merged PRs in 30d
Description
This causes a heap-buffer-overflow detected by ASAN
https://godbolt.org/z/Eno9r737M
https://github.com/boostorg/process/blob/develop/include/boost/process/environment.hpp#L263-L269
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with include/boost/process/environment.hpp around lines 263-269 and reproduce the heap-buffer-overflow using the linked Godbolt ASAN example. Trace the environment-variable lookup with keys of unequal sizes. Done means the lookup no longer triggers the reported overflow under ASAN.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- operating-systems
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100