chakra-core / chakra-core/ChakraCore
No checks for overflow's
- Dominant language
- JavaScript
- Stars
- 9.3k
- Forks
- 1.2k
- PR merge metrics
- No merged PRs in 30d
Description
Hi Team,
`https://github.com/Microsoft/ChakraCore/blob/master/pal/inc/pal.h#L4821`
Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120).
Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused).
Request team to please have a look.
Cheers!
Contributor guide
Research direction
Start at pal/inc/pal.h around line 4821 and inspect the copy operation, its destination size, and the callers that provide the buffer. Confirm the overflow risk, choose a bounds-safe approach compatible with the project, and verify that the affected PAL behavior remains correct without permitting writes past the destination.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100