google / google/flatbuffers

Out-of-bounds memory access in memcpy_downward when in_use sizes exceed buffer sizes

Open Beginner friendly
#9,162 0 comments 1 reaction 0 assignees View on GitHub
Dominant language
C++
Stars
26.5k
Forks
3.7k
PR merge metrics
No merged PRs in 30d

Description

The current implementation of
https://github.com/google/flatbuffers/blob/81edeb17d9118143f2c81caf27edfb0df401279e/include/flatbuffers/allocator.h#L57
performs no out-of-bounds checks. Without bounds checks writes past buffer boundaries are possible which can lead to memory corruption.

Adding the following asserts will protect against misuse.
```c++
void memcpy_downward(uint8_t* old_p, size_t old_size, uint8_t* new_p,
size_t new_size, size_t in_use_back, size_t in_use_front) {
FLATBUFFERS_ASSERT(in_use_back <= old_size);
FLATBUFFERS_ASSERT(in_use_back <= new_size);
memcpy(new_p + new_size - in_use_back, old_p + old_size - in_use_back,
in_use_back);
FLATBUFFERS_ASSERT(in_use_front <= old_size);
FLATBUFFERS_ASSERT(in_use_front <= new_size);
memcpy(new_p, old_p, in_use_front);
}
```

Contributor guide

Open the contributing guide

Research direction

Start in include/flatbuffers/allocator.h at memcpy_downward, using the linked implementation as the entry point. Check how its old_size, new_size, in_use_back, and in_use_front arguments are used. Done means oversized in-use values are rejected before either memcpy can access outside the buffers.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
security
Issue type
Bug
Difficulty
1/5
Estimated time
Under an hour
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
84/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.