bug(developer): in-memory buffer maximum lengths in GetXStringImpl are inconsistently calculated and may overflow in places
- Dominant language
- Pascal
- Stars
- 534
- Forks
- 143
- Avg merge
- 2d 10h
- Merged PRs (30d)
- 113
Description
`GetXStringImpl` has a number of places where buffer boundary conditions are incorrectly calculated. In some cases, the issue is marginal as it means the reduction in available buffer size of just one or two characters, e.g. see differences in available buffer lengths calculated in tests for `CERR_OutsTooLong`, `CERR_ExtendedStringTooLong`, `CERR_VirtualKeyExpansionTooLong`, `CERR_CharacterRangeTooLong` (kmc-kmn / test-messages.ts).
But in other places the problem is more serious, as buffer overflows can and do happen, e.g. in this code and other similar places, we don't check `mx` before incrementing and go past the end of the buffer:
https://github.com/keymanapp/keyman/blob/e983818bda9a2bcfc8758d70ccd0c7b7aaf5285c/developer/src/kmcmplib/src/Compiler.cpp#L1946-L1954
The overflow is generally only 2-3 characters max so one potential mitigation is to just allocate a larger buffer, but we should clearly fix the tests in a consistent manner.
Contributor guide
Assessment
This issue has not been assessed yet.