Out-of-bounds memory access in memcpy_downward when in_use sizes exceed buffer sizes
- Dominant language
- C++
- Stars
- 26.5k
- Forks
- 3.7k
- PR merge metrics
- No merged PRs in 30d
Description
The current implementation of
https://github.com/google/flatbuffers/blob/81edeb17d9118143f2c81caf27edfb0df401279e/include/flatbuffers/allocator.h#L57
performs no out-of-bounds checks. Without bounds checks writes past buffer boundaries are possible which can lead to memory corruption.
Adding the following asserts will protect against misuse.
```c++
void memcpy_downward(uint8_t* old_p, size_t old_size, uint8_t* new_p,
size_t new_size, size_t in_use_back, size_t in_use_front) {
FLATBUFFERS_ASSERT(in_use_back <= old_size);
FLATBUFFERS_ASSERT(in_use_back <= new_size);
memcpy(new_p + new_size - in_use_back, old_p + old_size - in_use_back,
in_use_back);
FLATBUFFERS_ASSERT(in_use_front <= old_size);
FLATBUFFERS_ASSERT(in_use_front <= new_size);
memcpy(new_p, old_p, in_use_front);
}
```
Contributor guide
Research direction
Start in include/flatbuffers/allocator.h at memcpy_downward, using the linked implementation as the entry point. Check how its old_size, new_size, in_use_back, and in_use_front arguments are used. Done means oversized in-use values are rejected before either memcpy can access outside the buffers.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- security
- Issue type
- Bug
- Difficulty
- 1/5
- Estimated time
- Under an hour
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 84/100