keymanapp / keymanapp/keyman

bug(developer): in-memory buffer maximum lengths in GetXStringImpl are inconsistently calculated and may overflow in places

Open
#11,136 1 comment 0 reactions 0 assignees View on GitHub
bug developer/
Dominant language
Pascal
Stars
534
Forks
143
Avg merge
2d 10h
Merged PRs (30d)
113

Description

`GetXStringImpl` has a number of places where buffer boundary conditions are incorrectly calculated. In some cases, the issue is marginal as it means the reduction in available buffer size of just one or two characters, e.g. see differences in available buffer lengths calculated in tests for `CERR_OutsTooLong`, `CERR_ExtendedStringTooLong`, `CERR_VirtualKeyExpansionTooLong`, `CERR_CharacterRangeTooLong` (kmc-kmn / test-messages.ts).

But in other places the problem is more serious, as buffer overflows can and do happen, e.g. in this code and other similar places, we don't check `mx` before incrementing and go past the end of the buffer:

https://github.com/keymanapp/keyman/blob/e983818bda9a2bcfc8758d70ccd0c7b7aaf5285c/developer/src/kmcmplib/src/Compiler.cpp#L1946-L1954

The overflow is generally only 2-3 characters max so one potential mitigation is to just allocate a larger buffer, but we should clearly fix the tests in a consistent manner.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.