intel / intel/confidential-computing.sgx.sdk

Invalid free in SampleCode/LocalAttestation/EnclaveInitiator/EnclaveInitiator.cpp

Open
#79 1 comment 1 reaction 0 assignees View on GitHub
bug
Dominant language
C++
Stars
2
Forks
3
PR merge metrics
No merged PRs in 30d

Description

Hello,

An uninitialized pointer can be freed in the `test_message_exchange` function in `SampleCode/LocalAttestation/EnclaveInitiator/EnclaveInitiator.cpp`. Specifically, [`out_buff`](https://github.com/intel/linux-sgx/blob/73b8b57aea306d1633cc44a2efc40de6f4217364/SampleCode/LocalAttestation/EnclaveInitiator/EnclaveInitiator.cpp#L77) is supposed to be initialized by function `send_request_receive_response` whereas this may not happen, when, e.g., memory allocation fails at the line below.

https://github.com/intel/linux-sgx/blob/73b8b57aea306d1633cc44a2efc40de6f4217364/SampleCode/LocalAttestation/EnclaveInitiator/EnclaveMessageExchange.cpp#L188-L190

However, `out_buff` is [freed](https://github.com/intel/linux-sgx/blob/73b8b57aea306d1633cc44a2efc40de6f4217364/SampleCode/LocalAttestation/EnclaveInitiator/EnclaveInitiator.cpp#L101) even when it is not initialized.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.