chakra-core / chakra-core/ChakraCore

No checks for overflow's

Open
#5,092 2 comments 0 reactions 0 assignees View on GitHub
Suggestion
Dominant language
JavaScript
Stars
9.3k
Forks
1.2k
PR merge metrics
No merged PRs in 30d

Description

Hi Team,

`https://github.com/Microsoft/ChakraCore/blob/master/pal/inc/pal.h#L4821`

Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120).
Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused).

Request team to please have a look.

Cheers!

Contributor guide

Open the contributing guide

Research direction

Start at pal/inc/pal.h around line 4821 and inspect the copy operation, its destination size, and the callers that provide the buffer. Confirm the overflow risk, choose a bounds-safe approach compatible with the project, and verify that the affected PAL behavior remains correct without permitting writes past the destination.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.