intel / intel/confidential-computing.sgx.sdk
Strange logic in EnclaveMessageExchange.cpp of LocalAttestation sample code
- Dominant language
- C++
- Stars
- 2
- Forks
- 3
- PR merge metrics
- No merged PRs in 30d
Description
Line 389 of EnclaveMessageExchange.cpp in function `send_request_receive_response` contains the following code:
if(sizeof(resp_message) > max_resp_message_length)
{
SAFE_FREE(req_message);
SAFE_FREE(resp_message);
return INVALID_PARAMETER_ERROR;
}
Here, `resp_message` is a pointer to a `secure_message_t` struct (it's allocated with `malloc` on line 358, a few lines above this snippet) and `max_resp_message_length` is defined as:
max_resp_message_length = sizeof(secure_message_t)+ max_out_buff_size;
(i.e. the same size used in the `malloc` of `resp_message`.)
Is this intended? I'm not sure what is being checked here...
Contributor guide
Assessment
This issue has not been assessed yet.